Class: Unified2::Event

Inherits:
Object
  • Object
show all
Defined in:
lib/unified2/event.rb

Overview

Event

Constant Summary collapse

EVENT_TYPES =

Normal Event headers types

[7, 72, 104, 105]
EXTRA =

Extra Data Event Header Types

[ 110 ]
LEGACY_EVENT_TYPES =

Legacy Event Header Types

[7, 72]
PACKET_TYPES =

Packet Event Header Types

[2]

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(id, position) ⇒ Event

Initialize event

Parameters:

  • id (Integer) —

    Event id



52
53
54
55
56
57
 
# File 'lib/unified2/event.rb', line 52

def initialize(id, position)
  @id = id.to_i
  @position = position
  @packets = []
  @extras = []
end

Instance Attribute Details

#event ⇒ Object

Setup method defaults



44
45
46
 
# File 'lib/unified2/event.rb', line 44

def event
  @event
end

#extras {|Extra| ... } ⇒ Array

Extras

Yields:

  • (Extra) —

    yield event extra objects

Returns:

  • (Array) —

    Extra object array



44
45
46
 
# File 'lib/unified2/event.rb', line 44

def extras
  @extras
end

#id ⇒ Object

Setup method defaults



44
45
46
 
# File 'lib/unified2/event.rb', line 44

def id
  @id
end

#next_position ⇒ Object

Setup method defaults



44
45
46
 
# File 'lib/unified2/event.rb', line 44

def next_position
  @next_position
end

#packets {|Packet| ... } ⇒ Array

Packets

Yields:

Returns:

  • (Array) —

    Packet object array



44
45
46
 
# File 'lib/unified2/event.rb', line 44

def packets
  @packets
end

#position ⇒ Object

Setup method defaults



44
45
46
 
# File 'lib/unified2/event.rb', line 44

def position
  @position
end

Instance Method Details

#checksum ⇒ String

Checksum

Create a unique checksum for each event using the ip source, destination, signature id, generator id, sensor id, severity id, and the classification id.

Returns:



92
93
94
95
 
# File 'lib/unified2/event.rb', line 92

def checksum
  checkdum = [ip_source, ip_destination, signature.id, signature.generator, sensor.id, severity, classification.id]
  Digest::MD5.hexdigest(checkdum.join(''))
end

#classification ⇒ Classification

Classification

Returns:



179
180
181
 
# File 'lib/unified2/event.rb', line 179

def classification
  Classification.new(@event_data[:classification])
end

#destination_port ⇒ Integer

Note:

Event#destination_port will return zero if the event protocol is icmp.

Destination Port

Returns:

  • (Integer) —

    Event destination port



234
235
236
 
# File 'lib/unified2/event.rb', line 234

def destination_port
  @event_data[:destination_port]
end

#event_time ⇒ Time? Also known as: timestamp

Event Time

The event timestamp created by unified2.

Returns:

  • (Time, nil) —

    Event time object



104
105
106
 
# File 'lib/unified2/event.rb', line 104

def event_time
  Time.at(@event_data[:timestamp].to_i)
end

#extras? ⇒ True, False

Has Extra Data

Returns:

  • (True, False) —

    Does the event have extra data?



285
286
287
 
# File 'lib/unified2/event.rb', line 285

def extras?
  @extras.empty?
end

#icmp? ⇒ true, false

ICMP?

Returns:

  • (true, false) —

    Check is protocol is icmp



143
144
145
 
# File 'lib/unified2/event.rb', line 143

def icmp?
  protocol == :ICMP
end

#ip_destination ⇒ IPAddr Also known as: destination_ip

Destination IP Address

Returns:

  • (IPAddr) —

    Event destination ip address



220
221
222
 
# File 'lib/unified2/event.rb', line 220

def ip_destination
  @event_data[:destination_ip]
end

#ip_source ⇒ IPAddr Also known as: source_ip

Source IP Address

Returns:

  • (IPAddr) —

    Event source ip address



197
198
199
 
# File 'lib/unified2/event.rb', line 197

def ip_source
  @event_data[:source_ip]
end

#json ⇒ String

Convert To Json

Returns:

  • (String) —

    Event hash in json format



363
364
365
 
# File 'lib/unified2/event.rb', line 363

def json
  to_h.to_json
end

#length ⇒ Integer

Event length

Returns:

  • (Integer) —

    Event length



64
65
66
 
# File 'lib/unified2/event.rb', line 64

def length
  @event_data[:header][:length].to_i
end

#load(event) ⇒ nil

Load

Initializes the raw data returned by bindata into a more comfortable format.

Parameters:

  • Name (Hash) —

    Description

Returns:

  • (nil) 


299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
 
# File 'lib/unified2/event.rb', line 299

def load(event)

  if EXTRA.include?(event.header.u2type)
    extra = Extra.new(event)
    @extras.push(extra)
  end

  if EVENT_TYPES.include?(event.header.u2type)
    @event = event
    @event_data = build_event_data
  end

  if PACKET_TYPES.include?(event.header.u2type)
    packet = Packet.new(build_packet_data(event))
    @packets.push(packet)
  end

end

#microseconds ⇒ String?

Microseconds

The event time in microseconds.

Returns:

  • (String, nil) —

    Event microseconds



116
117
118
 
# File 'lib/unified2/event.rb', line 116

def microseconds
  @event_data[:event_microsecond]
end

#packet_action ⇒ Integer?

Packet Action

Returns:

  • (Integer, nil) —

    Packet action



134
135
136
 
# File 'lib/unified2/event.rb', line 134

def packet_action
  @event_data[:packet_action]
end

#packet_time ⇒ Time?

Packet Time

Time of creation for the unified2 packet.

Returns:

  • (Time, nil) —

    Packet time object



75
76
77
78
79
80
 
# File 'lib/unified2/event.rb', line 75

def packet_time
  if @packet_data.has_key?(:packet_second)
    @packet_data[:packet_second]
    @timestamp = Time.at(@packet_data[:packet_second].to_i)
  end
end

#packets? ⇒ True, False

Has Packet Data

Returns:

  • (True, False) —

    Does the event have packet data?



264
265
266
 
# File 'lib/unified2/event.rb', line 264

def packets?
  @packets.empty?
end

#protocol ⇒ Protocol

Protocol

Returns:



170
171
172
 
# File 'lib/unified2/event.rb', line 170

def protocol
  @protocol ||= determine_protocol
end

#sensor ⇒ Sensor

Sensor

Returns:



125
126
127
 
# File 'lib/unified2/event.rb', line 125

def sensor
  @sensor ||= Unified2.sensor
end

#severity ⇒ Integer

Severity

Returns:

  • (Integer) —

    Event severity id



243
244
245
 
# File 'lib/unified2/event.rb', line 243

def severity
  @severity = @event_data[:priority_id].to_i
end

#signature ⇒ Signature?

Signature

Returns:

  • (Signature, nil) —

    Event signature object



188
189
190
 
# File 'lib/unified2/event.rb', line 188

def signature
  @signature ||= Signature.new(@event_data[:signature])
end

#source_port ⇒ Integer

Note:

Event#source_port will return zero if the event protocol is icmp.

Source Port

Returns:

  • (Integer) —

    Event source port



211
212
213
 
# File 'lib/unified2/event.rb', line 211

def source_port
  @event_data[:source_port]
end

#tcp? ⇒ true, false

TCP?

Returns:

  • (true, false) —

    Check is protocol is tcp



152
153
154
 
# File 'lib/unified2/event.rb', line 152

def tcp?
  protocol == :TCP
end

#to_h ⇒ Hash

Convert To Hash

Returns:

  • (Hash) —

    Event hash object



323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
 
# File 'lib/unified2/event.rb', line 323

def to_h
  @event_data[:position] = position
  @event_data[:next_position] = next_position.to_i

  @event_data[:protocol] = protocol
  @event_data[:timestamp] = timestamp.to_s
  @event_data[:checksum] = checksum
  @event_data[:sensor] = sensor.to_h

  @to_hash = {
    :event => @event_data,
    :packets => [],
    :extras => []
  }

  extras.each do |extra|
    @to_hash[:extras].push(extra.to_h)
  end

  packets.each do |packet|
    @to_hash[:packets].push(packet.to_h)
  end

  @to_hash
end

#to_i ⇒ Integer

Convert To Integer

Returns:

  • (Integer) —

    Event id



354
355
356
 
# File 'lib/unified2/event.rb', line 354

def to_i
  @id.to_i
end

#to_s ⇒ String

Convert To String

Returns:

  • (String) —

    Event string object



372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
 
# File 'lib/unified2/event.rb', line 372

def to_s
  data = "EVENT\n"
  data += "\tevent id: #{id}\n"
  data += "\tsensor id: #{sensor.id}\n"
  data += "\ttimestamp: #{timestamp.strftime('%D %H:%M:%S')}\n"
  data += "\tseverity: #{severity}\n"
  data += "\tprotocol: #{protocol}\n"
  data += "\tsource ip: #{source_ip} (#{source_port})\n"
  data += "\tdestination ip: #{destination_ip} (#{destination_port})\n"
  data += "\tsignature: #{signature.name}\n"
  data += "\tclassification: #{classification.name}\n"
  data += "\tchecksum: #{checksum}\n"

  packet_count = 1
  length = packets.count

  packets.each do |packet|
    data += "\n\tPACKET  (#{packet_count} of #{length})\n\n"

    data += "\tsensor id: #{sensor.id}"
    data += "\tevent id: #{id}"
    data += "\tevent second: #{packet.event_timestamp.to_i}\n"
    data += "\tpacket second: #{packet.timestamp.to_i}"
    data += "\tpacket microsecond: #{packet.microsecond.to_i}\n"
    data += "\tlinktype: #{packet.link_type}"
    data += "\tpacket length: #{packet.length}\n"
    data += "\tchecksum: #{packet.checksum}\n\n"

    hexdump = packet.hexdump(:width => 16)
    hexdump.each_line { |line| data += "\t" + line }

    packet_count += 1
  end

  extra_count = 1
  length = extras.count

  extras.each do |extra|
    data += "\n\tEXTRA   (#{extra_count} of #{length})\n\n"

    data += "\tname: #{extra.name}"
    data += "\tevent type: #{extra.header[:event_type]}"
    data += "\tevent length: #{extra.header[:event_length]}\n"
    data += "\tsensor id: #{sensor.id}"
    data += "\tevent id: #{id}"
    data += "\tevent second: #{extra.timestamp}\n"
    data += "\ttype: #{extra.type_id}"
    data += "\tdata type: #{extra.data_type}"
    data += "\tlength: #{extra.length}\n"
    data += "\tvalue: " + extra.value + "\n"

    extra_count += 1
  end

  data += "\n"
end

#udp? ⇒ true, false

UDP?

Returns:

  • (true, false) —

    Check is protocol is udp



161
162
163
 
# File 'lib/unified2/event.rb', line 161

def udp?
  protocol == :UDP
end