20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
|
# File 'lib/logstash/filters/opnsensefilter.rb', line 20
def filter(event)
if @field_name
data = event.get(@field_name).split(",")
event.set("#{@prefix}rule", data[0].to_i)
event.set("#{@prefix}subrule", data[3].to_i)
event.set("#{@prefix}input_interface", data[4])
event.set("#{@prefix}reason", data[5])
event.set("#{@prefix}action", data[6])
event.set("#{@prefix}direction_of_traffic", data[7])
event.set("#{@prefix}ip_version", data[8].to_i)
if data[8].to_i == 4
ip_proto = true
proto_start = 20
protocol = data[16]
event.set("#{@prefix}tos", data[9].to_i(16))
event.set("#{@prefix}ecn", data[10])
event.set("#{@prefix}hop_limit", data[11].to_i)
event.set("#{@prefix}aid", data[12].to_i)
event.set("#{@prefix}myoffset", data[13].to_i)
event.set("#{@prefix}flags", data[14])
event.set("#{@prefix}protocol_id", data[15].to_i)
event.set("#{@prefix}protocol", data[16])
event.set("#{@prefix}length", data[17].to_i)
event.set("#{@prefix}source", data[18])
event.set("#{@prefix}destination", data[19])
elsif data[8].to_i == 6
ip_proto = true
proto_start = 17
protocol = data[12]
event.set("#{@prefix}klass", data[9].to_i(16))
event.set("#{@prefix}flow_label", data[10].to_i(16))
event.set("#{@prefix}hop_limit", data[11].to_i)
event.set("#{@prefix}protocol", data[12])
event.set("#{@prefix}protocol_id", data[13].to_i)
event.set("#{@prefix}length", data[14].to_i)
event.set("#{@prefix}source", data[15])
event.set("#{@prefix}destination", data[16])
end
if ip_proto
if protocol.downcase == "tcp" || protocol.downcase == "udp"
event.set("#{@prefix}spt", data[proto_start].to_i)
event.set("#{@prefix}dpt", data[proto_start + 1].to_i)
event.set("#{@prefix}length", data[proto_start + 2].to_i)
end
if protocol.downcase == "tcp"
event.set("#{@prefix}tcp_flags", data[proto_start + 3])
event.set("#{@prefix}sequence_number", data[proto_start + 4])
event.set("#{@prefix}ack_number", data[proto_start + 5].to_i)
event.set("#{@prefix}window", data[proto_start + 6].to_i)
event.set("#{@prefix}urgent_pointer", data[proto_start + 7])
event.set("#{@prefix}options", data[proto_start + 8])
end
end
end
filter_matched(event)
end
|