Class: Suricata::Surilizer
- Inherits:
-
Object
- Object
- Suricata::Surilizer
- Defined in:
- lib/suricata/surilizer.rb
Overview
Instance Attribute Summary collapse
-
#lines ⇒ Object
readonly
Returns the value of attribute lines.
-
#logfile ⇒ Object
Returns the value of attribute logfile.
-
#src ⇒ Object
readonly
Returns the value of attribute src.
Instance Method Summary collapse
- #analyze ⇒ Object
- #getUniqEvents ⇒ Object
-
#initialize(file = nil) ⇒ Surilizer
constructor
A new instance of Surilizer.
- #result ⇒ Object
Constructor Details
#initialize(file = nil) ⇒ Surilizer
33 34 35 36 37 38 39 |
# File 'lib/suricata/surilizer.rb', line 33 def initialize(file = nil) @logfile = Suricata::Logfile.new(file) if not file.nil? @src = Hash.new @dst = Hash.new @lines = Counter.new end |
Instance Attribute Details
#lines ⇒ Object (readonly)
Returns the value of attribute lines
31 32 33 |
# File 'lib/suricata/surilizer.rb', line 31 def lines @lines end |
#logfile ⇒ Object
Returns the value of attribute logfile
30 31 32 |
# File 'lib/suricata/surilizer.rb', line 30 def logfile @logfile end |
#src ⇒ Object (readonly)
Returns the value of attribute src
31 32 33 |
# File 'lib/suricata/surilizer.rb', line 31 def src @src end |
Instance Method Details
#analyze ⇒ Object
43 44 45 46 47 48 49 50 51 52 53 54 55 56 |
# File 'lib/suricata/surilizer.rb', line 43 def analyze() @logfile.readline_parse do |entry| @lines.increase addCounter(@src,entry.conn.src) addEntry(@src[entry.conn.src],'dst',Hash) addCounter(@src[entry.conn.src]['dst'],entry.conn.dst) addEntry(@src[entry.conn.src]['dst'][entry.conn.dst],'desc',Hash) addCounter(@src[entry.conn.src]['dst'][entry.conn.dst]['desc'],entry.description) @src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['prio'] = entry.priority @src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['class'] = entry.classification end end |
#getUniqEvents ⇒ Object
58 59 60 61 62 63 64 65 66 67 68 69 70 |
# File 'lib/suricata/surilizer.rb', line 58 def getUniqEvents a = Array.new @src.each do |key,val| val['dst'].each do |keya,vala| val['dst'][keya]['desc'].each do |keyb,valb| a.push([keyb,val['dst'][keya]['desc'][keyb]['prio']]) end end end return a.uniq end |
#result ⇒ Object
72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 |
# File 'lib/suricata/surilizer.rb', line 72 def result events = getUniqEvents puts "======== Suricata Log Analysis ========" puts "Events: #{@lines}" puts "Unique Sources: #{@src.length}" puts "Unique Events: #{events.length}" puts "\n" puts "======== Unique Events =========" puts "\n" puts "PRIORITY\t| DESCRIPTION " events.sort{ |x,y| x[1] <=> y[1]}.each do |e| puts "#{e[1]}\t\t| #{e[0]}" end puts "\n" puts "======== Eventy by source ========" @src.each do |key,val| puts "Source: #{key}" val['dst'].each do |keya,vala| puts "\t-> #{keya}\n" val['dst'][keya]['desc'].each do |keyb,valb| puts "\t\t#{valb['counter'].count} x #{keyb} Prio: #{valb['prio']}\n" end end puts "" end end |