class Suricata::Fast

This class parses suricatas fast.log-files

Attributes

classification[RW]

@!attribute timestamp

log-time

@!attribute id

signature-id

@!attribute description

signature-description

@!attribute classification

threat-classification

@!attribute priority

priority

@!attribute conn

Suricata::Connection connection
conn[RW]

@!attribute timestamp

log-time

@!attribute id

signature-id

@!attribute description

signature-description

@!attribute classification

threat-classification

@!attribute priority

priority

@!attribute conn

Suricata::Connection connection
description[RW]

@!attribute timestamp

log-time

@!attribute id

signature-id

@!attribute description

signature-description

@!attribute classification

threat-classification

@!attribute priority

priority

@!attribute conn

Suricata::Connection connection
id[RW]

@!attribute timestamp

log-time

@!attribute id

signature-id

@!attribute description

signature-description

@!attribute classification

threat-classification

@!attribute priority

priority

@!attribute conn

Suricata::Connection connection
priority[RW]

@!attribute timestamp

log-time

@!attribute id

signature-id

@!attribute description

signature-description

@!attribute classification

threat-classification

@!attribute priority

priority

@!attribute conn

Suricata::Connection connection
timestamp[RW]

@!attribute timestamp

log-time

@!attribute id

signature-id

@!attribute description

signature-description

@!attribute classification

threat-classification

@!attribute priority

priority

@!attribute conn

Suricata::Connection connection

Public Instance Methods

getThreat() click to toggle source
# File lib/suricata/fast.rb, line 74
def getThreat
        return [ @description, @priority, @classification ]
end
parse(string) click to toggle source

this function parses an entry of fast.log @param [String] string one line of fast.log @raise [Exception] if string is nil

# File lib/suricata/fast.rb, line 46
def parse(string)
        if string.nil?
                raise "Invalid argument"
        end

        if string =~ /^([^ ]+)\s+/
                @timestamp = $1.chomp(' ')
        end

        if string =~ /\[\*\*\]\s+\[(\d+\:\d+\:\d+)\]\s+(.*)\[\*\*\]/
                @id = $1
                @description = $2.chomp(' ')
        end

        if string =~ /\[Classification: ([^\]]+)\]/
                @classification = $1
        end

        if string =~ /\[Priority: ([^\]]+)\]/
                @priority = $1
        end

        if string =~ /\]\s+([^\]]+)$/
                @conn = Suricata::Connection.new($1)
        end

end
to_s() click to toggle source

this function converts the parsed entry back to string @return [String] converted string

# File lib/suricata/fast.rb, line 80
def to_s
        "#{@timestamp} [**] [#{@id}] #{@description} [**] [Classification: #{@classification}] [Priority: #{@priority}] #{@conn}"
end