Module: Nwsdk::Constants

Included in:

Content

Defined in:

lib/nwsdk/constants.rb

Constant Summary

NW_TIME_FORMAT =

'%Y-%b-%d %H:%M:%S'

NW_VARIANT_DAYS =

%w{
  Sunday
  Monday
  Tuesday
  Wednesday
  Thursday
  Friday
  Saturday
}

NW_CONTENT_TYPE_AUTO =

Nwsdk Content Render Types

0,   # Auto Select HTML Content View
NW_CONTENT_TYPE_DETAILS        = 1,   # HTML Meta Details View
NW_CONTENT_TYPE_TEXT           = 2,   # HTML Text View
NW_CONTENT_TYPE_HEX            = 3,   # HTML Hex View
NW_CONTENT_TYPE_PACKETS        = 4,   # HTML Packet View
NW_CONTENT_TYPE_MAIL           = 5,   # HTML Mail View
NW_CONTENT_TYPE_WEB            = 6,   # HTML Web Page View
NW_CONTENT_TYPE_VOIP           = 7,   # HTML VOIP View
NW_CONTENT_TYPE_IM             = 8,   # HTML IM View
NW_CONTENT_TYPE_FILES          = 9,   # HTML Listing of all files found in session
NW_CONTENT_TYPE_PCAP           = 100, # Pcap Packet File
NW_CONTENT_TYPE_RAW            = 102, # Raw Content
NW_CONTENT_TYPE_XML            = 103, # Meta XML File
NW_CONTENT_TYPE_CSV            = 104, # Meta Comma Separated File
NW_CONTENT_TYPE_TXT            = 105, # Meta Tab Separated File
NW_CONTENT_TYPE_NWD            = 106, # Netwitness Data File
NW_CONTENT_TYPE_FILE_EXTRACTOR = 107, # Extract files from common protocols
NW_CONTENT_TYPE_LOGS           = 108, # Log extract (captured logs, LF delimited)
NW_CONTENT_TYPE_PROTOBUF       = 109

NW_CONTENT_FLAG_STREAM1 =

Nwsdk Content Render Flags

0x00001, # Return only request stream
                                            #   content.
NW_CONTENT_FLAG_STREAM2          = 0x00002, # Return only response stream
                                            #   content.
NW_CONTENT_FLAG_SINGLE_COLUMN    = 0x00004, # Format generated web page as
                                            #   a single column with requests
                                            #   and responses interleaved.
NW_CONTENT_FLAG_PACKET_PAYLOAD   = 0x00008, # Include only session payload.
NW_CONTENT_FLAG_DECODEAS_EBCDIC  = 0x00010, # Convert session payload from EBCDIC to ASCII.
NW_CONTENT_FLAG_DO_NOT_EMBED     = 0x00020, # Do not embed application/
                                            #   audio/video traffic into the
                                            #   generated web page.
NW_CONTENT_FLAG_UNCOMPRESS_TEXT  = 0x00040, # Unzip web content in text view.
NW_CONTENT_FLAG_DECODE_SSL       = 0x00080, # Attempt to decrypt SSL
                                            #   sessions if the encryption
                                            #   key is provided.
NW_CONTENT_FLAG_STRIP_STYLE_TAGS = 0x00100, # Removes all <style> tags from the original
                                            #   html document.
NW_CONTENT_FLAG_IGNORE_CACHE     = 0x01000, # Ignore any content in cache
                                            #   and requery, affects only
                                            #   current request.
NW_CONTENT_FLAG_NO_EMBEDDED_EXE  = 0x02000, # Do not look for or extract
                                            #   hidden/embedded PE files
                                            #   when performing file
                                            #   extraction.
NW_CONTENT_FLAG_INCLUDE_DUPS     = 0x04000, # Include packets otherwise removed by assembly
NW_CONTENT_FLAG_INCLUDE_HEADERS  = 0x08000, # Include packet header meta information
NW_CONTENT_FLAG_CAPTURE_ORDER    = 0x10000

DEFAULT_CONFIG =

d.‘e’fault config

{
  "endpoint"=> {
    "user"=>"admin",
    "pass"=>"netwitness",
    "host"=>"broker.local",
    "port"=>"50103"
  },
  "syslog"=>{
    "loghost"=>"loghost.local",
    "logport"=>514
  },
  "cef_static_fields"=> {
    "deviceVendor"=>"ERCOT",
    "deviceProduct"=>"nwsdk",
    "deviceCustomString1Label"=>"threat.desc",
    "deviceCustomString2Label"=>"threat.source",
    "deviceCustomString3Label"=>"threat.category",
    "deviceCustomNumber1Label"=>"asn.src",
    "deviceCustomNumber2Label"=>"asn.dst"
  },
  "cef_mapping" => {
    "action"=>"deviceAction",
    "alias.host"=>"destinationProcessName",
    "asn.dst"=>"deviceCustomNumber2",
    "asn.src"=>"deviceCustomNumber1",
    "did"=>"deviceHostName",
    "directory"=>"filePath",
    "domain.dst"=>"destinationHostName",
    "eth.dst"=>"destinationMacAddress",
    "eth.src"=>"sourceMacAddress",
    "filename"=>"fileName",
    "ip.dst"=>"destinationAddress",
    "ip.proto"=>"transportProtocol",
    "ip.src"=>"sourceAddress",
    "risk.warning"=>"name",
    "risk.suspicious"=>"name",
    "service"=>"applicationProtocol",
    "sessionid"=>"externalId",
    "size"=>"bytesIn",
    "tcp.dstport"=>"destinationPort",
    "tcp.srcport"=>"sourcePort",
    "threat.desc"=>"deviceCustomString1",
    "threat.source"=>"deviceCustomString2",
    "threat.category"=>"deviceCustomString3",
    "udp.dstport"=>"destinationPort",
    "udp.srcport"=>"sourcePort",
    "username"=>"destinationUserName"
  }
}