class Suricata::Fast
This class parses suricatas fast.log-files
Attributes
@!attribute timestamp
log-time
@!attribute id
signature-id
@!attribute description
signature-description
@!attribute classification
threat-classification
@!attribute priority
priority
@!attribute conn
Suricata::Connection connection
@!attribute timestamp
log-time
@!attribute id
signature-id
@!attribute description
signature-description
@!attribute classification
threat-classification
@!attribute priority
priority
@!attribute conn
Suricata::Connection connection
@!attribute timestamp
log-time
@!attribute id
signature-id
@!attribute description
signature-description
@!attribute classification
threat-classification
@!attribute priority
priority
@!attribute conn
Suricata::Connection connection
@!attribute timestamp
log-time
@!attribute id
signature-id
@!attribute description
signature-description
@!attribute classification
threat-classification
@!attribute priority
priority
@!attribute conn
Suricata::Connection connection
@!attribute timestamp
log-time
@!attribute id
signature-id
@!attribute description
signature-description
@!attribute classification
threat-classification
@!attribute priority
priority
@!attribute conn
Suricata::Connection connection
@!attribute timestamp
log-time
@!attribute id
signature-id
@!attribute description
signature-description
@!attribute classification
threat-classification
@!attribute priority
priority
@!attribute conn
Suricata::Connection connection
Public Instance Methods
# File lib/suricata/fast.rb, line 74 def getThreat return [ @description, @priority, @classification ] end
this function parses an entry of fast.log @param [String] string one line of fast.log @raise [Exception] if string is nil
# File lib/suricata/fast.rb, line 46 def parse(string) if string.nil? raise "Invalid argument" end if string =~ /^([^ ]+)\s+/ @timestamp = $1.chomp(' ') end if string =~ /\[\*\*\]\s+\[(\d+\:\d+\:\d+)\]\s+(.*)\[\*\*\]/ @id = $1 @description = $2.chomp(' ') end if string =~ /\[Classification: ([^\]]+)\]/ @classification = $1 end if string =~ /\[Priority: ([^\]]+)\]/ @priority = $1 end if string =~ /\]\s+([^\]]+)$/ @conn = Suricata::Connection.new($1) end end
this function converts the parsed entry back to string @return [String] converted string
# File lib/suricata/fast.rb, line 80 def to_s "#{@timestamp} [**] [#{@id}] #{@description} [**] [Classification: #{@classification}] [Priority: #{@priority}] #{@conn}" end