Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
#!/usr/bin/perl -w
#
# Copyright (C) 2011-2013 Cesnet z.s.p.o
#
# Use of this source is governed by a BSD-style license, see LICENSE file.
use strict;
use DateTime;
use Getopt::Std;
#-------------------------------------------------------------------------------
# Warden 2.2. Command-line Client, Sender
#
# Command-line warden-client sender. For detailed info how to use particular
# variables and/or values see warden-client/doc/README file.
#-------------------------------------------------------------------------------
#-------------------------------------------------------------------------------
# Preparation of event attributes.
# Mandatory attributes
our $opt_s; # service
our $opt_d = "" . DateTime->from_epoch(epoch => time()) . ""; # time of detection
our $opt_t; # type of detected event
our $opt_o; # event source type
# Optional attributes
our $opt_v = ""; # event source value
our $opt_p = ""; # target protocol
our $opt_r = ""; # target port
our $opt_a = ""; # attack scale
our $opt_n = ""; # note
# Other attributes
our $opt_w = "../../warden-client"; # path to warden directory
our $opt_h; # display help
# Check whether mandatory fields are given. Otherwise print help and exit.
if (!getopts("s:d:t:o:v:p:r:a:n:w:h") ||
!defined($opt_s) || !defined($opt_t) || !defined($opt_o) ||
$opt_h) {
print "\nUsage: ./command-line-sender.pl [-s <service>] [-d <timestamp_of_detection>] [-t <type>] [-o <source_type>] [-v <source>] [-p <protocol>] [-r <port>] [-a <attack_scale>] [-n <note>] [-w <warden_directory>] [-h]\n";
print "\nArguments:\n\n";
print "-s <service> - Name of detection service\n";
print "-d <timestamp_of_detection> - Timestamp of detection.
Default is current system time (" . DateTime->from_epoch(epoch => time()) . ")\n";
print "-t <type> - Type of detected event\n";
print "-o <source_type> - Type of detected event\'s source\n";
print "\n";
print "Optional (but important) arguments:\n\n";
print "-v <source> - Source of detected event\n";
print "-p <protocol> - Protocol\n";
print "-r <port> - Port\n";
print "-a <attack_scale> - Scale of detected event\n";
print "-n <note> - Note, comment or other data\n";
print "-w <warden_directory> - Path to warden-client directory. Default is \'../../warden-client\'\n";
print "-h - Print this help\n";
print "\nExample: ./command-line-sender.pl -s test -t webattack -o URL -v 123.123.098.098 -p TCP -r 443 -a 100 -n \"important notice\"\n";
print "\nNOTE: For more information how to use particular values see warden-client/doc/README file.\n\n";
exit 0;
}
my @event = ($opt_s, $opt_d, $opt_t, $opt_o, $opt_v,
$opt_p, $opt_r, $opt_a, $opt_n);
#-------------------------------------------------------------------------------
# Use of warden-client sender.
# Path to warden-client folder
my $warden_path = $opt_w;
# Inclusion of warden-client sender module
require $warden_path . '/lib/WardenClientSend.pm';
# Sending event to Warden server
WardenClientSend::saveNewEvent($warden_path, \@event);
exit 0;