class Suricata::Surilizer

src-ip][counter
src-ip][dst
src-ip][counter
src-ip][desc][counter

Attributes

lines[R]
logfile[RW]
src[R]

Public Class Methods

new(file = nil) click to toggle source
# File lib/suricata/surilizer.rb, line 33
def initialize(file = nil)

        @logfile = Suricata::Logfile.new(file) if not file.nil?
        @src = Hash.new
        @dst = Hash.new
        @lines = Counter.new
end

Public Instance Methods

analyze() click to toggle source
# File lib/suricata/surilizer.rb, line 43
def analyze()
        @logfile.readline_parse do |entry|
                @lines.increase
                addCounter(@src,entry.conn.src)
                addEntry(@src[entry.conn.src],'dst',Hash)
                addCounter(@src[entry.conn.src]['dst'],entry.conn.dst)
                addEntry(@src[entry.conn.src]['dst'][entry.conn.dst],'desc',Hash)
                addCounter(@src[entry.conn.src]['dst'][entry.conn.dst]['desc'],entry.description)
                @src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['prio'] = entry.priority
                @src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['class'] = entry.classification
        end


end
getUniqEvents() click to toggle source
# File lib/suricata/surilizer.rb, line 58
def getUniqEvents
        a = Array.new
        @src.each do |key,val|
                val['dst'].each do  |keya,vala|
                val['dst'][keya]['desc'].each do  |keyb,valb|
                        a.push([keyb,val['dst'][keya]['desc'][keyb]['prio']])
                end

                end
        end

        return a.uniq
end
result() click to toggle source
# File lib/suricata/surilizer.rb, line 72
def result
        events = getUniqEvents
        puts "======== Suricata Log Analysis ========"
        puts "Events: #{@lines}"
        puts "Unique Sources: #{@src.length}"
        puts "Unique Events: #{events.length}"
        puts "\n"
        puts "======== Unique Events ========="
        puts "\n"
        puts "PRIORITY\t| DESCRIPTION "
        events.sort{ |x,y| x[1] <=> y[1]}.each do |e|
                puts "#{e[1]}\t\t| #{e[0]}"
        end
        puts "\n"

        puts "======== Eventy by source ========"
        @src.each do |key,val|
                puts "Source: #{key}"
                val['dst'].each do  |keya,vala|
                puts "\t-> #{keya}\n"
                val['dst'][keya]['desc'].each do  |keyb,valb|
                        puts "\t\t#{valb['counter'].count} x #{keyb} Prio: #{valb['prio']}\n"
                end

                end
                puts ""
        end

end

Private Instance Methods

addCounter(val,entry) click to toggle source
# File lib/suricata/surilizer.rb, line 103
def addCounter(val,entry)
                if not val.key?(entry)
                        val[entry] = Hash.new
                        val[entry]['counter'] = Counter.new(1)
                else
                        val[entry]['counter'].increase
                end
end
addEntry(val,entry,type) click to toggle source
# File lib/suricata/surilizer.rb, line 112
def addEntry(val,entry,type)
        if not val.key?(entry)
                val[entry] = type.new
        end
end