+++ /dev/null
-#!/usr/bin/perl -w\r
-use Socket;\r
-use POSIX 'setsid';\r
-use strict;\r
-use ossecmysql;\r
-# ---------------------------------------------------------------------------\r
-# Author: Meir Michanie (meirm@riunx.com)\r
-# Co-Author: J.A.Senger (jorge@br10.com.br)\r
-# $Id$\r
-# ---------------------------------------------------------------------------\r
-# http://www.riunx.com/\r
-# ---------------------------------------------------------------------------\r
-#\r
-# ---------------------------------------------------------------------------\r
-# About this script\r
-# ---------------------------------------------------------------------------\r
-#\r
-# "Ossec to Snorby" records the OSSEC HIDS alert logs in MySQL database.\r
-# It can run as a daemon (ossec2snorby.pl), recording in real-time the logs in database or\r
-# as a simple script (ossec2snorby.pl).\r
-#\r
-# ---------------------------------------------------------------------------\r
-# Snorby support by Jean-Pierre Zurbrugg (jp.zurbrugg@live.com)\r
-# ---------------------------------------------------------------------------\r
-# The original script by the Author and Co-author was taken as a template and\r
-# modified to work with Snorby (http://snorby.org) which uses a Snort DB schema.\r
-# Credit must go to the author\Co-author for the initial template. \r
-#\r
-########################### WARNING ###############################\r
-# My modifications are by far stable and worthy of a production environment\r
-# WHITHOUT INICIAL TWEAKING. Please setup your labs and make sure everything\r
-# works properly before using this script on a production environment.\r
-########################### WARNING ###############################\r
-#\r
-#\r
-# Changelog:\r
-# * Extra validations were added to make sure srcip\dstip do not remain with\r
-# a default value of "0" which causes GUI parsing errors if left unhandled.\r
-# * Validation against '$hostname'; if localhost then srcip="127.0.0.1"\r
-# * Snorby expects IP related data to be published on its "iphdr" table.\r
-# * Snorby expects OSSEC's logs to be converted to HEX and wordwrapped.\r
-# * Modified the scripts "Daemon" mode; it now uses "tail -Fn 0 <file>"\r
-#\r
-# ---------------------------------------------------------------------------\r
-# Prerequisites\r
-# ---------------------------------------------------------------------------\r
-#\r
-# MySQL Server\r
-# Perl DBD::mysql module\r
-# Perl DBI module\r
-#\r
-# Snorby prerequesites:\r
-# import ossec2snorby_category.sql from contrib directory\r
-# Populate "domain" in /etc/ossec2snorby.conf\r
-#\r
-# ---------------------------------------------------------------------------\r
-# Installation steps\r
-# ---------------------------------------------------------------------------\r
-# \r
-# 1) Create a user to access the database initially created by Snorby;\r
-# 2) Copy ossec2snorby.conf to /etc/ossec2snorby.conf with 0600 permissions\r
-# 3) Edit /etc/ossec2snorby.conf according to your needs:\r
-# dbhost=localhost\r
-# database=snorby\r
-# debug=5\r
-# dbport=3306\r
-# dbpasswd=mypassword\r
-# dbuser=ossecuser\r
-# daemonize=0\r
-# resolve=1\r
-# domain=mydomain.local\r
-#\r
-# NOTE: It is recommended to keep "resolve" as "1" and populate "domain" with\r
-# your actual domain. Not doing so will restrict the script and force it\r
-# to populate IPs as "0.0.0.1" for events whose SRC or DST IP are unknown.\r
-#\r
-# ---------------------------------------------------------------------------\r
-# License\r
-# ---------------------------------------------------------------------------\r
-#\r
-# This program is free software; you can redistribute it and/or\r
-# modify it under the terms of the GNU General Public License\r
-# as published by the Free Software Foundation; either version 2\r
-# of the License, or (at your option) any later version.\r
-#\r
-# This program is distributed in the hope that it will be useful,\r
-# but WITHOUT ANY WARRANTY; without even the implied warranty of\r
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\r
-# GNU General Public License for more details.\r
-#\r
-# You should have received a copy of the GNU General Public License\r
-# along with this program; if not, write to the Free Software\r
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.\r
-#\r
-# ---------------------------------------------------------------------------\r
-# About OSSEC HIDS\r
-# ---------------------------------------------------------------------------\r
-#\r
-# OSSEC HIDS is an Open Source Host-based Intrusion Detection System.\r
-# It performs log analysis and correlation, integrity checking,\r
-# rootkit detection, time-based alerting and active response.\r
-# http://www.ossec.net\r
-#\r
-# ---------------------------------------------------------------------------\r
-\r
-# ---------------------------------------------------------------------------\r
-# Parameters\r
-# ---------------------------------------------------------------------------\r
-my $VERSION="0.4";\r
-$SIG{TERM} = sub { &gracefulend('TERM')};\r
-$SIG{INT} = sub { &gracefulend('INT')};\r
-\r
-# If no ARGV are given then present &help().\r
-&help() unless @ARGV;\r
-\r
-my ($RUNASDAEMON)=0;\r
-my ($DAEMONLOGFILE)='/var/log/ossec2snorby.log';\r
-my ($DAEMONLOGERRORFILE) = '/var/log/ossec2snorby.err';\r
-# Declare OSSEC's log path and filename format.\r
-my $LOG='/var/ossec/logs/alerts/alerts.log'; # we need to tail this file instead of the old.\r
- # With this we can survive file rotations while\r
- # running in daemon mode.\r
-\r
-my ($LOGGER)='ossec2snorby';\r
-my($OCT) = '(?:25[012345]|2[0-4]\d|1?\d\d?)';\r
-my($IP) = $OCT . '\.' . $OCT . '\.' . $OCT . '\.' . $OCT;\r
-my $dump=0;\r
-my ($hids_id,$hids,$hids_interface,$last_cid)=(undef, 'localhost', 'ossec',0);\r
-my ($tempvar,$VERBOSE)=(0,0); \r
-\r
-my %conf;\r
-$conf{dbhost}='localhost';\r
-$conf{database}='snort';\r
-$conf{debug}=5;\r
-$conf{dbport}='3306';\r
-$conf{dbpasswd}='password';\r
-$conf{dbuser}='user';\r
-$conf{daemonize}=0;\r
-$conf{sensor}='sensor';\r
-$conf{hids_interface}='ossec';\r
-$conf{resolve}=1;\r
-$conf{domain}='';\r
-\r
-# OSSEC's default class_ID\r
-# We will categorize events as "unknown" if a match could not be found...\r
-my $sig_class_id=2; # We will try to fetch the correct class_id later.\r
-\r
-my($sig_class_name,$taillog);\r
-# ---------------------------------------------------------------------------\r
-# Arguments parsing\r
-# ---------------------------------------------------------------------------\r
-while (@ARGV){\r
- $_= shift @ARGV;\r
- if (m/^-d$|^--daemon$/){\r
- $conf{daemonize}=1;\r
- }elsif ( m/^-h$|^--help$/){\r
- &help();\r
- }elsif ( m/^-n$|^--noname$/){\r
- $conf{'resolve'}=0;\r
- }elsif ( m/^-v$|^--verbose$/){\r
- $VERBOSE=1;\r
- }elsif ( m/^--interface$/){\r
- $conf{hids_interface}= shift @ARGV if @ARGV; # ossec-rt/ossec-feed\r
- }elsif ( m/^--sensor$/){\r
- $conf{sensor}= shift @ARGV if @ARGV; # monitor\r
- }elsif ( m/^--conf$/){\r
- $conf{conf}= shift @ARGV if @ARGV; # localhost\r
- &loadconf(\%conf);\r
- }elsif ( m/^--dbhost$/){\r
- $conf{dbhost}= shift @ARGV if @ARGV; # localhost\r
- }elsif ( m/^--dbport$/){\r
- $conf{dbport}= shift @ARGV if @ARGV; # localhost\r
- }elsif ( m/^--dbname$/){\r
- $conf{database}= shift @ARGV if @ARGV; # snort\r
- }elsif ( m/^--dbuser$/){\r
- $conf{dbuser}= shift @ARGV if @ARGV; # root\r
- }elsif ( m/^--dbpass$/){\r
- $conf{dbpasswd}= shift @ARGV if @ARGV; # monitor\r
- }\r
-\r
-}\r
-if ($conf{dbpasswd}=~ m/^--stdin$/){\r
- print "dbpassword:";\r
- $conf{dbpasswd}=<>;\r
- chomp $conf{dbpasswd};\r
-}\r
-$hids=$conf{sensor} if exists($conf{sensor});\r
-$hids_interface=$conf{hids_interface} if exists($conf{hids_interface});\r
-\r
-# START IN DAEMON MODE ?\r
-&daemonize() if $conf{daemonize};\r
-\r
-my $dbi= ossecmysql->new(%conf) || die ("Could not connect to $conf{dbhost}:$conf{dbport}:$conf{database} as $conf{dbpasswd}\n");\r
-\r
-####\r
-# SQL vars;\r
-my ($query,$numrows,$row_ref);\r
-\r
-####\r
-#get sensor id\r
-$query= 'select sid,last_cid from sensor where hostname=? and interface=?';\r
-$numrows= $dbi->execute($query,$hids,$hids_interface);\r
-if (1==$numrows){\r
- $row_ref=$dbi->{sth}->fetchrow_hashref;\r
- $hids_id=$row_ref->{sid};\r
- $last_cid=$row_ref->{last_cid};\r
-}else{\r
- $query="INSERT INTO sensor ( sid , hostname , interface , filter , detail , encoding , last_cid )\r
-VALUES (\r
-NULL , ?, ? , NULL , ? , ?, ?\r
-)";\r
- $numrows= $dbi->execute($query,$hids,$hids_interface,1,2,0);\r
- $hids_id=$dbi->lastid();\r
-}\r
-$dbi->{sth}->finish;\r
-&forceprintlog ("SENSOR:$hids; feed:$hids_interface; id:$hids_id; last cid:$last_cid");\r
-\r
-my $newrecord=0;\r
-my %stats;\r
-my %resolv;\r
-my ($timestamp,$sec,$mail,$date,$alerthost,$alerthostip,$datasource,$rule,$level,$description,\r
- $srcip,$dstip,$user,$text,$filtered,$osseclevel)=();\r
-my $lasttimestamp=0;\r
-my $delta=0;\r
-\r
-&taillog($last_cid,$LOG);\r
-################################################################\r
-sub forceprintlog(){\r
- $tempvar=$VERBOSE;\r
- $VERBOSE=1;\r
- &printlog (@_);\r
- $VERBOSE=$tempvar;\r
-}\r
-\r
-sub taillog {\r
- my ($last_cid,$LOG)=@_;\r
- while (<>) {\r
- if (m/^$/){\r
- # we reached a newline, finish up with current record.\r
- $newrecord=1;\r
- next unless $timestamp;\r
- $alerthostip=$alerthost if $alerthost=~ m/^$IP$/;\r
- \r
- # Populate DST IP\r
- if ($alerthostip){\r
- $dstip=$alerthostip;\r
- $resolv{$alerthost}=$dstip;\r
-\r
- }else{\r
- if (exists $resolv{$alerthost}){\r
- $dstip=$resolv{$alerthost};\r
- }else{\r
- if ($conf{'resolve'}){\r
- if ($alerthost =~m/(\d+\.\d+\.\d+\.\d+)/ ){\r
- $dstip=$1;\r
- }else{\r
- # the "host" command doesn't work with Flatname\NetBIOS names.\r
- # The server's hostname is almost always a flatname and OSSEC\r
- # doesn't return an IP for alerts generated from localhost.\r
- # Ex. 2013 Jan 24 15:51:36 ubuntu->/var/log/auth.log \r
- my $x = `cat /etc/hostname`; # get Host's hostname\r
- chomp $x; # remove extra lines, if any.\r
- if ($x eq $alerthost) { # Validate if $alerthost is us, localhost.\r
- $dstip='127.0.0.1'; # Snorby does not allow empty\"0" as IP value.\r
- }else{\r
- my $fetch=&host2ip($alerthost);\r
- \r
- if (defined $fetch){\r
- $dstip=$fetch;\r
- }else{\r
- $dstip=$srcip;\r
- }\r
- }\r
- }\r
- }\r
- $resolv{$alerthost}=$dstip;\r
- }\r
- }\r
- \r
- #Populate SRC IP (requires dstip to be populated)\r
- if (! defined $srcip) {\r
- if (defined $dstip) {\r
- #Feb 6 15:18:21 1.1.1.1 %ASA-3-313001: Denied ICMP type=3, code=3 from 111.111.1.1 on interface OUTSIDE\r
- $filtered =~ s/$dstip//; # filter out known dstip from log output.\r
- $srcip=$1 if $filtered=~ m/\s($IP)\s/; # Search all text for an IP address.\r
- # This could easily bug out with logs that contains\r
- # version numbering such as mysql 1.3.4.5.\r
- }\r
- # Windows logs include "User Name" in their log output. Some companies name their employees's PCs after its users which is\r
- # resolvable via DNS.\r
- # Windows logs may state a computer name as "User Name". Lets strip out the "$" from the computer name...\r
- if (defined $user and ! defined $srcip) {\r
- my $u=$user;\r
- $u=~ s/\$//; # remove "$" from computer names.\r
-\r
- my $fetch=&host2ip($u);\r
- $srcip=$fetch if (defined $fetch);\r
- }\r
- if (! defined $srcip or $srcip eq '') {\r
- # NO recognizable IPs or User Names were found on log output,\r
- # this suggests the log was generated by dstip.\r
- $srcip=$dstip; \r
- }\r
- }\r
- #\r
- $last_cid= &prepair2basedata(\r
- $hids_id,\r
- $last_cid,\r
- $timestamp,\r
- $sec,\r
- $mail,\r
- $date,\r
- $alerthost,\r
- $datasource,\r
- $rule,\r
- $level,\r
- $description,\r
- $srcip,\r
- $dstip,\r
- $user,\r
- $text\r
- );\r
- ($timestamp,$sec,$mail,$date,$alerthost,$alerthostip,$datasource,$rule,$level,$description,\r
- $srcip,$dstip,$user,$text)=();\r
- next ;\r
- }\r
- if (m/^\*\* Alert ([0-9]+).([0-9]+):(.*)$/){\r
- $timestamp=$1;\r
- if ( $timestamp == $lasttimestamp){\r
- $delta++;\r
- }else{\r
- $delta=0;\r
- $lasttimestamp=$timestamp;\r
- }\r
- $sec=$2;\r
- $mail=$3;\r
- $mail=$mail ? $mail : 'nomail';\r
-#2006 Aug 29 17:19:52 firewall -> /var/log/messages\r
-#2006 Aug 30 11:52:14 192.168.0.45->/var/log/secure\r
-#2006 Sep 12 11:12:16 92382-Snort1 -> 172.16.176.132\r
- }elsif ( m/^([0-9]+\s\w+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+)\s+(\S+)\s*->(.*)$/){\r
- $date=$1;\r
- $alerthost=$2;\r
- $datasource=$3;\r
- if ($datasource=~ m/(\d+\.\d+\.\d+\.\d+)/){\r
- $alerthost=$1;\r
- $datasource="remoted";\r
- }\r
-#2006 Aug 29 17:33:31 (recepcao) 10.0.3.154 -> syscheck\r
- }elsif ( m/^([0-9]+\s\w+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+)\s+\((.*?)\)\s+(\S+)\s*->(.*)$/){\r
- $date=$1;\r
- $alerthost=$2;\r
- $alerthostip=$3;\r
- $datasource=$4;\r
- }elsif ( m/^([0-9]+\s\w+\s[0-9]+\s[0-9]+:[0-9]+:[0-9]+)\s(.*?)$/){\r
- $date=$1;\r
- $alerthost='localhost';\r
- $datasource=$2;\r
- }elsif ( m/Rule: ([0-9]+) \(level ([0-9]+)\) -> \'(.*)\'$/ ){\r
- $rule=$1;\r
- $level=$2;\r
- $osseclevel=$level; # Keep copy of OSSEC level as it will later be converted to snort level.\r
- $description= $3;\r
- }elsif ( m/src\s?ip:/i){\r
- if ( m/($IP)/){\r
- $srcip=$1;\r
- }else{\r
- $srcip='1'; # Snorby doesn't like srcip\dstip = 0\null.\r
- }\r
- }elsif ( m/User: (.*)$/){\r
- $user=$1;\r
- }elsif ( m/(.*)$/){\r
- my $x=$1;\r
- \r
- # Get IP from User Name + DNS query.\r
- if (! defined $user){\r
- if ( m/User\s?Name:\s?(\S+)\s/i){\r
- my $u=$1;\r
- $user="$u";\r
- }\r
- }\r
- $x =~ s/(.$)/$1\r\n/; # lets multiline this string for cleaner output once $payload wordwraps it.\r
- $text .=$x;\r
- \r
- # This variable will be used to populate srcip once we reach the end of the current log entry.\r
- $filtered=$text;\r
- }\r
- } # End of while read line\r
-}\r
-\r
-sub ossec_aton(){\r
- my ($ip)=@_;\r
- if ($ip=~ m/(\d+)\.(\d+)\.(\d+)\.(\d+)/){\r
- my $num= ($1 * 256 ** 3) + ($2 * 256 ** 2)+ ($3 * 256 ** 1)+ ($4);\r
-\r
- return "$num";\r
- }else{\r
- return "1"; # Snorby has a bug where it wont ouput "N\A" on the IP columns if srcip\dstip = 0\null\r
- }\r
-\r
-}\r
-\r
-sub prepair2basedata(){\r
- my (\r
- $hids_id,\r
- $last_cid,\r
- $timestamp,\r
- $sec,\r
- $mail,\r
- $date,\r
- $alerthost,\r
- $datasource,\r
- $rule,\r
- $level,\r
- $description,\r
- $srcip,\r
- $dstip,\r
- $user,\r
- $text\r
- )=@_;\r
- my ($payload,$count,$query,$row_ref,$sig_id);\r
- \r
- \r
-###\r
-# Get sig_class_id\r
-#\r
-# Note: the original script stated sig_class_id as "1" by default which in BASE might be ok but for \r
-# snorby it maps to a category of "not-suspicious" which is not efficient when stats are ran based on\r
-# event categories alone...\r
-#\r
-# Furthermore, OSSEC allows a rule to have multiple categories assigned to it which snorby was not prepared to handle GUI\r
-# wize. (The event details contains a small section where the category value can be shown, this section is too small\r
-# to show OSSEC's sometimes long category results such as :\r
-# syslog,sshd,invalid_login,authentication_failed,)\r
-#\r
-# We will use the last category shown only...This isn't the correct approach but my programing skills prevent me\r
-# from providing a better solution.\r
-\r
- # ex: - syslog,sshd,invalid_login,authentication_failed,\r
- if ($mail=~ m/\.*\,?(\w+\_?\w+)\,?$/){ # $mail contains the rule's categories. No clue why its named $mail...\r
- $sig_class_name=$1;\r
- &printlog ("SIG_CLASS_NAME: $sig_class_name \n");\r
- $query = "SELECT sig_class_id FROM category WHERE cat_name=?";\r
- $dbi->execute($query,$sig_class_name);\r
- $count=$dbi->{sth}->rows;\r
- if ($count){\r
- $row_ref=$dbi->{sth}->fetchrow_hashref;\r
- $sig_class_id=$row_ref->{sig_class_id};\r
- &printlog ("SIG_CLASS_ID: $sig_class_id");\r
- }else{\r
- &printlog ("SIG_CLASS_ID NOT FOUND. USING DEFAULT SIG.");\r
- $sig_class_id=2;\r
- }\r
- }else{\r
- &printlog ("COULD NOT GET A RULE CATEGORY. USING DEFAULT SIG.");\r
- $sig_class_id=2;\r
- }\r
-\r
-###\r
-#\r
-# Get/Set signature id\r
-\r
- # Convert OSSEC Severity to Snort Severity.\r
- # Dont modify this after having live data on Snorby as it will create duplicated\r
- # sig_names.\r
- $level=4 if ($level <= 4); # Informational only.\r
- $level=3 if ($level == 5); # User generated errors \ low severity.\r
- $level=2 if (($level >= 6) && ($level <=11)); # Low to mid severity attacks.\r
- $level=1 if ($level >= 12); # High importance events \ Successfull attacks \ all our bases belong to them!\r
-\r
- $query = "SELECT sig_id FROM signature where sig_name=? and sig_class_id=? and sig_priority=? and sig_rev=? and sig_sid=? and sig_gid is NULL";\r
- $dbi->execute($query,$description,$sig_class_id,$level,0,$rule);\r
- $count=$dbi->{sth}->rows;\r
- if ($count){\r
- $row_ref=$dbi->{sth}->fetchrow_hashref;\r
- $sig_id=$row_ref->{sig_id};\r
- &printlog ("REUSING SIGNATURE\n");\r
- }else{\r
- $query="INSERT INTO signature ( sig_id , sig_name , sig_class_id , sig_priority , sig_rev , sig_sid , sig_gid )\r
-VALUES (\r
-NULL ,?, ? , ? , ? , ?, NULL\r
-)";\r
- $dbi->execute($query,$description,$sig_class_id,$level,0,$rule);\r
- $sig_id = $dbi->lastid();\r
- }\r
- $dbi->{sth}->finish;\r
- &printlog ("SIGNATURE: $sig_id\n");\r
- \r
- \r
- ############################\r
- ############################\r
- #DEBUG\r
- # &printlog ("filtered: $filtered \n");\r
- # &printlog ("SRC IP: $srcip \n");\r
- # &printlog ("DST IP: $dstip \n");\r
- # &printlog ("mail: $mail \n");\r
- # &printlog ("sig_class_name: $sig_class_name");\r
- # &printlog ("date: $date \n");\r
- # &printlog ("alerthost: $alerthost \n");\r
- # &printlog ("rule: $rule \n");\r
- # &printlog ("level: $level \n");\r
- # &printlog ("OSSEC level: $osseclevel \n");\r
- # &printlog ("USER: $user \n");\r
- # &printlog ("text: $text \n");\r
- # &printlog ("sec?: $sec \n");\r
- # &printlog ("datasource: $datasource \n");\r
- # &printlog ("description: $description \n");\r
- # exit 1;\r
- ############################\r
- \r
- \r
-#######\r
-#\r
-# Set event\r
- $query="INSERT INTO event ( sid , cid , signature , timestamp )\r
-VALUES (\r
-? , ? , ? ,? \r
-)";\r
- $last_cid++;\r
- $dbi->execute($query,$hids_id,$last_cid,$sig_id,&fixdate2base($date));\r
-\r
- &printlog ("EVENT: ($query,$hids_id,$last_cid,$sig_id,&fixdate2base($date)\n");\r
- $dbi->{sth}->finish;\r
-#########\r
-#\r
-# Set iphdr\r
-\r
- # And yet again,Snorby doesn't like empty IP fields; Validate if srcip or dstip are empty.\r
- $srcip = "1" if !defined $srcip; # leaving the fields srcip / dstip with a value = 0\r
- $dstip = "1" if !defined $dstip; # causes output to get messed up on the GUI. \r
-\r
- $query=" INSERT INTO iphdr ( sid , cid , ip_src , ip_dst , ip_ver , ip_hlen , ip_tos , ip_len , ip_id , ip_flags , ip_off , ip_ttl , ip_proto , ip_csum )\r
-VALUES (\r
-? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ? , ?\r
-) ";\r
- $dbi->execute($query,$hids_id,$last_cid,&ossec_aton($srcip),&ossec_aton($dstip),4,5,0,20,0,0,0,0,0,0);\r
- &printlog ("iphdr: ($query,$hids_id,$last_cid,&ossec_aton($srcip),&ossec_aton($dstip),4,5,0,undef,undef,undef,undef,undef,undef,undef)\n");\r
- $dbi->{sth}->finish;\r
-\r
-#########\r
-#\r
-#\r
-# Set data\r
- $payload = "$date ($alerthost) $dstip->$datasource\r\nRule: $rule (OSSEC level $osseclevel) -> $description\r\n$text";\r
- $payload =~ s/(.{1,109}\S|\S+)\s+/$1\r\n/mg; # Snorby does not wordwrap the payload, lets wrap the first 109 non-whitespace chars. \r
- $payload = unpack("H*",$payload); # Convert to HEX\r
-\r
- $query=" INSERT INTO data ( sid , cid , data_payload ) \r
-VALUES (\r
-?,?,?)";\r
- $dbi->execute($query,$hids_id,$last_cid,$payload);\r
- &printlog ("DATA: ($query,$hids_id,$last_cid,$payload)\n");\r
- $dbi->{sth}->finish;\r
-##########\r
-#\r
- $query="UPDATE sensor SET last_cid=? where sid=? limit 1";\r
- $numrows= $dbi->execute($query,$last_cid,$hids_id);\r
-\r
- $dbi->{sth}->finish;\r
- return $last_cid;\r
-} # end sub\r
-\r
-sub host2ip {\r
- # This sub requires argument 0 to be a named host. We also need to know\r
- # the domain to which we belong to in order to append it to the host if\r
- # its a flatname host.\r
- my $host=$_[0];\r
- my $domain=$conf{domain} if exists($conf{domain});\r
- my $CMD;\r
-\r
- # Validate if we were fed a flatnamed host or a FQDN.\r
- if ($host =~ m/.*\..+/){\r
- # FQDN\r
- $CMD=`host $host 2>/dev/null | grep 'has address' `;\r
- if ($CMD =~m/(\d+\.\d+\.\d+\.\d+)/ ){\r
- return($1);\r
- }else{\r
- return undef; # return False.\r
- }\r
- \r
- }else{\r
- # FLATNAME\r
- if (! defined $domain or $domain eq ''){\r
- &printlog ('[WARNING]: domain value was not populated on ossec2snorby.conf." . \r
- " DNS resolutions cannot be completed for NetBIOS\Flatname hosts.');\r
- return undef;\r
- }\r
-\r
- # There is an extra "." after $domain, this is to ensure linux\r
- # does not append "localdomain" at the end of the host.\r
- $CMD=`host $host.$domain. 2>/dev/null | grep 'has address' `;\r
- if ($CMD =~m/(\d+\.\d+\.\d+\.\d+)/ ){\r
- return($1);\r
- }else{\r
- return undef; # return False.\r
- }\r
- }\r
-}\r
-\r
-sub fixdate2base(){\r
- my ($date)=@_;\r
- $date=~ s/ Jan /-01-/;\r
- $date=~ s/ Feb /-02-/;\r
- $date=~ s/ Mar /-03-/;\r
- $date=~ s/ Apr /-04-/;\r
- $date=~ s/ May /-05-/;\r
- $date=~ s/ Jun /-06-/;\r
- $date=~ s/ Jul /-07-/;\r
- $date=~ s/ Aug /-08-/;\r
- $date=~ s/ Sep /-09-/;\r
- $date=~ s/ Oct /-10-/;\r
- $date=~ s/ Nov /-11-/;\r
- $date=~ s/ Dec /-12-/;\r
- $date=~ s/\s$//g;\r
- return $date;\r
-}\r
-sub version(){\r
- print "OSSEC report tool $VERSION\n";\r
- print "Licensed under GPL\n";\r
- print "Contributor Meir Michanie\n";\r
-}\r
-\r
-sub help(){\r
- &version();\r
- print "This tool helps you import into base the alerts generated by ossec."\r
- . " More info in the doc directory .\n";\r
- print "Usage:\n";\r
- print "$0 [-h|--help] # This text you read now\n";\r
- print "Options:\n";\r
- print "\t--dbhost <hostname>\n";\r
- print "\t--dbname <database>\n";\r
- print "\t--dbport <[0-9]+>\n";\r
- print "\t--dbpass <dbpasswd>\n";\r
- print "\t--dbuser <dbuser>\n";\r
- print "\t-d|--daemonize\n";\r
- print "\t-n|--noname\n";\r
- print "\t-v|--verbose\n";\r
- print "\t--conf <ossec2based-config>\n";\r
- print "\t--sensor <sensor-name>\n";\r
- print "\t--interface <ifname>\n";\r
- \r
- exit 0;\r
-}\r
-\r
-\r
-sub daemonize {\r
- my $running = kill 0, `cat /var/run/ossec2base2.pid`;\r
- if ($running){\r
- print "OSSEC2SNORBY is already running...\n";\r
- exit 1;\r
- }\r
-\r
- chdir '/' or die "Can't chdir to /: $!";\r
- \r
- open STDOUT, ">>$DAEMONLOGFILE"\r
- or die "Can't write to $DAEMONLOGFILE: $!";\r
-\r
- # I may be mistaken but the original script didn't seem to actually\r
- # tail the logs. It would run until it hit EOF and then exit script.\r
- $taillog= open STDIN,"-|", "/usr/bin/tail", "-Fn 0", "$LOG";\r
- if ($taillog){\r
- &forceprintlog ("Daemon started TAIL PID: $taillog");\r
- &forceprintlog ("NOW MONITORING: $LOG");\r
- }else{\r
- &forceprintlog ("Could not start daemon on $LOG: $!");\r
- exit 1;\r
- }\r
-\r
- defined(my $pid = fork) or die "Can't fork: $!";\r
- if ($pid){\r
- open (PIDFILE , ">/var/run/ossec2snorby.pid") ;\r
- print PIDFILE "$pid\n";\r
- close (PIDFILE);\r
- exit 0;\r
- }\r
- setsid or die "Can't start a new session: $!";\r
- open STDERR, ">>$DAEMONLOGERRORFILE" or die "Can't write to $DAEMONLOGERRORFILE: $!";\r
-}\r
-\r
-sub gracefulend(){\r
- my ($signal)=@_;\r
- &forceprintlog ("Terminating upon signal $signal");\r
- &forceprintlog ("Daemon halted");\r
- # This might be paranoid or simply useless but better safe than sorry.\r
- close STDOUT or die "WARNING: Closing STDOUT failed.";\r
- close STDERR or die "WARNING: Closing STDERR failed.";\r
- kill 3, $taillog or die "WARNING: Closing $taillog failed.";\r
- close STDIN or die "WARNING: Closing STDIN failed.";\r
- exit 0;\r
-}\r
-\r
-sub printlog(){\r
- return unless $VERBOSE;\r
- my (@lines)=@_;\r
- foreach my $line(@lines){\r
- chomp $line;\r
- my ($date)=scalar localtime;\r
- $date=~ s/^\S+\s+(\S+.*\s[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}).*$/$1/;\r
- print "$date $LOGGER: $line\n";\r
- }\r
- }\r
-\r
-\r
-sub loadconf(){\r
- my ($hash_ref)=@_;\r
- my $conf=$hash_ref->{conf};\r
- unless (-f $conf) { &printlog ("ERROR: I can't find config file $conf"); exit 1;}\r
- unless (open ( CONF , "$conf")){ &printlog ("ERROR: I can't open file $conf");exit 1;}\r
- while (<CONF>){\r
- next if m/^$|^#/;\r
- if ( m/^(\S+)\s?=\s?(.*?)$/) {\r
- $hash_ref->{$1} = $2;\r
- }\r
- }\r
- close CONF;\r
-}\r
projects / ossec-hids.git / blobdiff