class Suricata::Surilizer
- src-ip][counter
- src-ip][dst
- src-ip][counter
- src-ip][desc][counter
- src-ip][dst
Attributes
lines[R]
logfile[RW]
src[R]
Public Class Methods
new(file = nil)
click to toggle source
# File lib/suricata/surilizer.rb, line 33 def initialize(file = nil) @logfile = Suricata::Logfile.new(file) if not file.nil? @src = Hash.new @dst = Hash.new @lines = Counter.new end
Public Instance Methods
analyze()
click to toggle source
# File lib/suricata/surilizer.rb, line 43 def analyze() @logfile.readline_parse do |entry| @lines.increase addCounter(@src,entry.conn.src) addEntry(@src[entry.conn.src],'dst',Hash) addCounter(@src[entry.conn.src]['dst'],entry.conn.dst) addEntry(@src[entry.conn.src]['dst'][entry.conn.dst],'desc',Hash) addCounter(@src[entry.conn.src]['dst'][entry.conn.dst]['desc'],entry.description) @src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['prio'] = entry.priority @src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['class'] = entry.classification end end
getUniqEvents()
click to toggle source
# File lib/suricata/surilizer.rb, line 58 def getUniqEvents a = Array.new @src.each do |key,val| val['dst'].each do |keya,vala| val['dst'][keya]['desc'].each do |keyb,valb| a.push([keyb,val['dst'][keya]['desc'][keyb]['prio']]) end end end return a.uniq end
result()
click to toggle source
# File lib/suricata/surilizer.rb, line 72 def result events = getUniqEvents puts "======== Suricata Log Analysis ========" puts "Events: #{@lines}" puts "Unique Sources: #{@src.length}" puts "Unique Events: #{events.length}" puts "\n" puts "======== Unique Events =========" puts "\n" puts "PRIORITY\t| DESCRIPTION " events.sort{ |x,y| x[1] <=> y[1]}.each do |e| puts "#{e[1]}\t\t| #{e[0]}" end puts "\n" puts "======== Eventy by source ========" @src.each do |key,val| puts "Source: #{key}" val['dst'].each do |keya,vala| puts "\t-> #{keya}\n" val['dst'][keya]['desc'].each do |keyb,valb| puts "\t\t#{valb['counter'].count} x #{keyb} Prio: #{valb['prio']}\n" end end puts "" end end
Private Instance Methods
addCounter(val,entry)
click to toggle source
# File lib/suricata/surilizer.rb, line 103 def addCounter(val,entry) if not val.key?(entry) val[entry] = Hash.new val[entry]['counter'] = Counter.new(1) else val[entry]['counter'].increase end end
addEntry(val,entry,type)
click to toggle source
# File lib/suricata/surilizer.rb, line 112 def addEntry(val,entry,type) if not val.key?(entry) val[entry] = type.new end end