diff --git a/suricata/get_CVE_list.py b/suricata/get_CVE_list.py new file mode 100644 index 0000000000000000000000000000000000000000..2e2c8a7400306e22f87c0f8eb821bc967098e3d9 --- /dev/null +++ b/suricata/get_CVE_list.py @@ -0,0 +1,59 @@ +import re +import os +import optparse +import sys + + +def get_args(): + parser = optparse.OptionParser( + usage="usage: %prog path", + description="Check all CVE records in Suricata detection rules and save them into CVE_list.txt") + parser.add_option( + "--path", + action="store", + help="Path to directory of Suricata detection rules") + return parser + +def main(): + optp = get_args() + opts, args = optp.parse_args() + if not opts.path: + optp.print_help() + sys.exit() + # suricata data log file + files_list = os.listdir(opts.path) + # look for pattern: (CVE|cve)(-|,)DDDD-DDDDDDDDDD---> + cve_re = re.compile('(?:cve|CVE)[-,]\d{4}-\d+') + # look for pattern: sid: XXXXXXXXX--->; + sig_id = re.compile('sid:.*?(?=;)') + for file in files_list: + # if has suffix .rules + if ".rules" in file: + # path to file + file_path = os.path.join(opts.path, file) + file_path_cve_list = os.path.join(os.getcwd(), "CVE_list.txt") + rule_file = open(file_path, 'r') + processed_rules_file = open(file_path_cve_list, 'a') + processed_rules_list = [] + for line in rule_file: + # look for lines with cve and signature and concat found results + if cve_re.search(line) and sig_id.search(line): + # find all cve's in line + actual_cve_record = cve_re.findall(line) + # convert cve to CVE and replace CVE,XXXX for CVE-XXXX + actual_cve_record = [y.replace("E,", "E-") for y in [x.upper() for x in actual_cve_record]] + # delete duplicity and concatenate + actual_cve_record = ', '.join(set(actual_cve_record)) + actual_sig_id = sig_id.search(line).group(0) + record = actual_sig_id.replace("sid", "signature_id") + " " + actual_cve_record + " -----> " + file + if record not in processed_rules_list: + processed_rules_list.append(record) + if processed_rules_list: + processed_rules_file.write("\n".join(sorted(processed_rules_list))) + processed_rules_file.write("\n") + processed_rules_list = [] + + +if __name__ == "__main__": + main() +