Skip to content
Snippets Groups Projects
Commit 426cc041 authored by Pavel Kácha's avatar Pavel Kácha
Browse files

Merge branch 'warden-3' of homeproj.cesnet.cz:warden into warden-3

parents f962be6c a06a23d1
No related branches found
No related tags found
No related merge requests found
...@@ -21,7 +21,7 @@ DEFAULT_NAME = 'org.example.warden.test' ...@@ -21,7 +21,7 @@ DEFAULT_NAME = 'org.example.warden.test'
DEFAULT_AWIN = 5 DEFAULT_AWIN = 5
def gen_event_idea(client_name, detect_time, win_start_time, win_end_time, conn_count, src_ip4, dst_ip4, aggr_win): def gen_event_idea(client_name, detect_time, win_start_time, win_end_time, conn_count, src_ip, dst_ip, aggr_win):
event = { event = {
"Format": "IDEA0", "Format": "IDEA0",
...@@ -32,14 +32,9 @@ def gen_event_idea(client_name, detect_time, win_start_time, win_end_time, conn_ ...@@ -32,14 +32,9 @@ def gen_event_idea(client_name, detect_time, win_start_time, win_end_time, conn_
"Category": ["Attempt.Login"], "Category": ["Attempt.Login"],
"Note": "SSH login attempt", "Note": "SSH login attempt",
"ConnCount": conn_count, "ConnCount": conn_count,
"Source": [ "Source": [{}],
{
"IP4": [src_ip4],
}
],
"Target": [ "Target": [
{ {
"IP4": [dst_ip4],
"Proto": ["tcp", "ssh"], "Proto": ["tcp", "ssh"],
"Port" : [22] "Port" : [22]
} }
...@@ -54,6 +49,10 @@ def gen_event_idea(client_name, detect_time, win_start_time, win_end_time, conn_ ...@@ -54,6 +49,10 @@ def gen_event_idea(client_name, detect_time, win_start_time, win_end_time, conn_
] ]
} }
af = "IP4" if not ':' in src_ip else "IP6"
event['Source'][0][af] = [src_ip]
event['Target'][0][af] = [dst_ip]
return event return event
def main(): def main():
...@@ -72,7 +71,7 @@ def main(): ...@@ -72,7 +71,7 @@ def main():
crs = con.cursor() crs = con.cursor()
events = [] events = []
query = "SELECT UNIX_TIMESTAMP(s.starttime) as starttime, s.ip, COUNT(s.id) as attack_scale, sn.ip as sensor \ query = "SELECT UNIX_TIMESTAMP(CONVERT_TZ(s.starttime, '+00:00', @@global.time_zone)) as starttime, s.ip, COUNT(s.id) as attack_scale, sn.ip as sensor \
FROM sessions s \ FROM sessions s \
LEFT JOIN sensors sn ON s.sensor=sn.id \ LEFT JOIN sensors sn ON s.sensor=sn.id \
WHERE s.starttime > DATE_SUB(UTC_TIMESTAMP(), INTERVAL + %s SECOND) \ WHERE s.starttime > DATE_SUB(UTC_TIMESTAMP(), INTERVAL + %s SECOND) \
...@@ -84,7 +83,7 @@ def main(): ...@@ -84,7 +83,7 @@ def main():
dtime = format_timestamp(row['starttime']) dtime = format_timestamp(row['starttime'])
etime = format_timestamp(time()) etime = format_timestamp(time())
stime = format_timestamp(time() - awin) stime = format_timestamp(time() - awin)
events.append(gen_event_idea(client_name = aname, detect_time = dtime, win_start_time = stime, win_end_time = etime, conn_count = row['attack_scale'], src_ip4 = row['ip'], dst_ip4 = row['sensor'], aggr_win = awin)) events.append(gen_event_idea(client_name = aname, detect_time = dtime, win_start_time = stime, win_end_time = etime, conn_count = row['attack_scale'], src_ip = row['ip'], dst_ip = row['sensor'], aggr_win = awin))
print "=== Sending ===" print "=== Sending ==="
start = time() start = time()
......
...@@ -588,7 +588,7 @@ def format_timestamp(epoch=None, utc=True, utcoffset=None): ...@@ -588,7 +588,7 @@ def format_timestamp(epoch=None, utc=True, utcoffset=None):
return format_time(*time.gmtime(epoch)[:6], microsec=us, utcoffset=utcoffset) return format_time(*time.gmtime(epoch)[:6], microsec=us, utcoffset=utcoffset)
def format_time(year, month, day, hour, minute, second, microsec=0, utcoffset=0): def format_time(year, month, day, hour, minute, second, microsec=0, utcoffset=None):
if utcoffset is None: if utcoffset is None:
utcoffset = -(time.altzone if time.daylight else time.timezone) utcoffset = -(time.altzone if time.daylight else time.timezone)
tstr = "%04d-%02d-%02dT%02d:%02d:%02d" % (year, month, day, hour, minute, second) tstr = "%04d-%02d-%02dT%02d:%02d:%02d" % (year, month, day, hour, minute, second)
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment