Class: Suricata::Surilizer

Inherits:
Object
  • Object
show all
Defined in:
lib/suricata/surilizer.rb

Overview

src-ip][counter
src-ip][dst
src-ip][counter
src-ip][desc][counter

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(file = nil) ⇒ Surilizer 


33
34
35
36
37
38
39
 
# File 'lib/suricata/surilizer.rb', line 33

def initialize(file = nil)

	@logfile = Suricata::Logfile.new(file) if not file.nil?
	@src = Hash.new
	@dst = Hash.new
	@lines = Counter.new
end

Instance Attribute Details

#lines ⇒ Object (readonly)

Returns the value of attribute lines


31
32
33
 
# File 'lib/suricata/surilizer.rb', line 31

def lines
  @lines
end

#logfile ⇒ Object

Returns the value of attribute logfile


30
31
32
 
# File 'lib/suricata/surilizer.rb', line 30

def logfile
  @logfile
end

#src ⇒ Object (readonly)

Returns the value of attribute src


31
32
33
 
# File 'lib/suricata/surilizer.rb', line 31

def src
  @src
end

Instance Method Details

#analyze ⇒ Object 


43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/suricata/surilizer.rb', line 43

def analyze()
	@logfile.readline_parse do |entry|
		@lines.increase
		addCounter(@src,entry.conn.src)
		addEntry(@src[entry.conn.src],'dst',Hash)
		addCounter(@src[entry.conn.src]['dst'],entry.conn.dst)
		addEntry(@src[entry.conn.src]['dst'][entry.conn.dst],'desc',Hash)
		addCounter(@src[entry.conn.src]['dst'][entry.conn.dst]['desc'],entry.description)
		@src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['prio'] = entry.priority
		@src[entry.conn.src]['dst'][entry.conn.dst]['desc'][entry.description]['class'] = entry.classification
	end


end

#getUniqEvents ⇒ Object 


58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/suricata/surilizer.rb', line 58

def getUniqEvents
	a = Array.new
	@src.each do |key,val|
		val['dst'].each do  |keya,vala|
		val['dst'][keya]['desc'].each do  |keyb,valb|
			a.push([keyb,val['dst'][keya]['desc'][keyb]['prio']])
		end

		end
	end

	return a.uniq
end

#result ⇒ Object 


72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/suricata/surilizer.rb', line 72

def result
	events = getUniqEvents
	puts "======== Suricata Log Analysis ========"
	puts "Events: #{@lines}"
	puts "Unique Sources: #{@src.length}"
	puts "Unique Events: #{events.length}"
	puts "\n"
	puts "======== Unique Events ========="
	puts "\n"
	puts "PRIORITY\t| DESCRIPTION "
	events.sort{ |x,y| x[1] <=> y[1]}.each do |e|
		puts "#{e[1]}\t\t| #{e[0]}"
	end
	puts "\n"

	puts "======== Eventy by source ========"
	@src.each do |key,val|
		puts "Source: #{key}"
		val['dst'].each do  |keya,vala|
		puts "\t-> #{keya}\n"
		val['dst'][keya]['desc'].each do  |keyb,valb|
			puts "\t\t#{valb['counter'].count} x #{keyb} Prio: #{valb['prio']}\n"
		end

		end
		puts ""
	end

end