diff --git a/warden3/contrib/connectors/hp-dio/README b/warden3/contrib/connectors/hp-dio/README
index 0da8928e9b7ea3d05f19ceaf5b9a1e322b11389b..2921f5caf803020e8b2af0ef316f20a25cae7dee 100644
--- a/warden3/contrib/connectors/hp-dio/README
+++ b/warden3/contrib/connectors/hp-dio/README
@@ -40,6 +40,13 @@ D. Configuration
warden - path to warden-client config, e.g. 'warden/warden_client.cfg'
name - sensor's source id used as a source of events, e.g. 'cz.cesnet.server.dionaea'
+ anonymised - no | yes | omit
+ - no (default value)
+ - yes = anonymize to 'target_net' (see below)
+ - omit = completely omit target field
+
+ target_net - anonymized network used as target if 'anonymized' option is 'yes'
+
dbfile - path to sqlite database file, e.g. '/opt/dionaea/var/dionaea/logsql.sqlite'
binaries_path - path to stored malware, e.g. '/opt/dionaea/var/dionaea/binaries'
report_binaries - 'true' if malware attachment have to be included in event, otherwise 'false'
@@ -49,7 +56,7 @@ D. Configuration
cron
SCRIPT_PATH=/opt/warden_client/
- */5 * * * * root cd $SCRIPT_PATH; warden3-dio-sender.py >> dio-sender.log
+ */5 * * * * root cd $SCRIPT_PATH; python warden3-dio-sender.py > /dev/null 2>&1
Note: Repeat interval must be the same as value of 'awin'.
diff --git a/warden3/contrib/connectors/hp-dio/warden3-dio-sender.py b/warden3/contrib/connectors/hp-dio/warden3-dio-sender.py
index 2271dabfd122f5ae3c52fdf950b6f2c3b96fa777..646ac29c791482cf4f6b81a36bcefd9cd5c7baa2 100644
--- a/warden3/contrib/connectors/hp-dio/warden3-dio-sender.py
+++ b/warden3/contrib/connectors/hp-dio/warden3-dio-sender.py
@@ -7,12 +7,14 @@
from warden_client import Client, Error, read_cfg, format_timestamp
import json
import string
+import urllib
from time import time, gmtime, strftime, sleep
from math import trunc
from uuid import uuid4
from os import path
import base64
import sqlite3
+import sys
DEFAULT_ACONFIG = 'warden_client-dio.cfg'
DEFAULT_WCONFIG = 'warden_client.cfg'
@@ -27,6 +29,8 @@ DEFAULT_ATTACH_NAME = 'att1'
DEFAULT_HASHTYPE = 'md5'
DEFAULT_CONTENT_TYPE = 'application/octet-stream'
DEFAULT_CONTENT_ENCODING = 'base64'
+DEFAULT_ANONYMISED = 'no'
+DEFAULT_TARGET_NET = '0.0.0.0/0'
def gen_attach_idea(logger, report_binaries, binaries_path, filename, hashtype, hashdigest, vtpermalink, avref):
@@ -46,6 +50,7 @@ def gen_attach_idea(logger, report_binaries, binaries_path, filename, hashtype,
refs.extend(avref.split(';'))
if refs:
+ refs = [urllib.quote(ref, safe=':') for ref in refs]
refs = list(set(refs))
attach['Ref'] = refs
@@ -63,7 +68,7 @@ def gen_attach_idea(logger, report_binaries, binaries_path, filename, hashtype,
return attach
-def gen_event_idea(logger, binaries_path, report_binaries, client_name, detect_time, win_start_time, win_end_time, aggr_win, data):
+def gen_event_idea(logger, binaries_path, report_binaries, client_name, anonymised, target_net, detect_time, win_start_time, win_end_time, aggr_win, data):
category = []
event = {
@@ -119,7 +124,13 @@ def gen_event_idea(logger, binaries_path, report_binaries, client_name, detect_t
event['Source'][0][af] = [data['src_ip']]
event['Source'][0]['Port'] = [data['src_port']]
- event['Target'][0][af] = [data['dst_ip']]
+ if anonymised != 'omit':
+ if anonymised == 'yes':
+ event['Target'][0]['Anonymised'] = True
+ event['Target'][0][af] = [target_net]
+ else:
+ event['Target'][0][af] = [data['dst_ip']]
+
event['Target'][0]['Port'] = [data['dst_port']]
event['Target'][0]['Proto'] = proto
@@ -132,17 +143,26 @@ def main():
wconfig = read_cfg(aconfig.get('warden', DEFAULT_WCONFIG))
aname = aconfig.get('name', DEFAULT_NAME)
- awin = aconfig.get('awin', DEFAULT_AWIN) * 60
+ wclient = Client(**wconfig)
+ wconfig['name'] = aname
+
+ awin = aconfig.get('awin', DEFAULT_AWIN) * 60
abinpath = aconfig.get('binaries_path', DEFAULT_BINPATH)
adbfile = aconfig.get('dbfile', DEFAULT_DBFILE)
aconattempts = aconfig.get('con_attempts', DEFAULT_CON_ATTEMPTS)
aretryinterval = aconfig.get('con_retry_interval', DEFAULT_CON_RETRY_INTERVAL)
areportbinaries = aconfig.get('report_binaries', DEFAULT_REPORT_BINARIES)
- wconfig['name'] = aname
+ aanonymised = aconfig.get('anonymised', DEFAULT_ANONYMISED)
+ if aanonymised not in ['no', 'yes', 'omit']:
+ wclient.logger.error("Configuration error: anonymised: '%s' - possible typo? use 'no', 'yes' or 'omit'" % aanonymised)
+ sys.exit(2)
+
+ atargetnet = aconfig.get('target_net', DEFAULT_TARGET_NET)
+ aanonymised = aanonymised if (atargetnet != DEFAULT_TARGET_NET) or (aanonymised == 'omit') else DEFAULT_ANONYMISED
+
- wclient = Client(**wconfig)
con = sqlite3.connect(adbfile)
con.row_factory = sqlite3.Row
@@ -177,12 +197,12 @@ def main():
if con:
con.close
- etime = format_timestamp(time(), False)
- stime = format_timestamp(time() - awin, False)
+ etime = format_timestamp(time())
+ stime = format_timestamp(time() - awin)
for row in rows:
- dtime = format_timestamp(row['timestamp'], False)
- events.append(gen_event_idea(logger = wclient.logger, binaries_path = abinpath, report_binaries = areportbinaries, client_name = aname, detect_time = dtime, win_start_time = stime, win_end_time = etime, aggr_win = awin, data = row))
+ dtime = format_timestamp(row['timestamp'])
+ events.append(gen_event_idea(logger = wclient.logger, binaries_path = abinpath, report_binaries = areportbinaries, client_name = aname, anonymised = aanonymised, target_net = atargetnet, detect_time = dtime, win_start_time = stime, win_end_time = etime, aggr_win = awin, data = row))
print "=== Sending ==="
start = time()
diff --git a/warden3/contrib/connectors/hp-dio/warden_client-dio.cfg b/warden3/contrib/connectors/hp-dio/warden_client-dio.cfg
index 4a314172d0bff7ae53616c90ec19178eebe6b8c9..391c9cc560b1c49053b17a9fa456aaba2e8ab092 100644
--- a/warden3/contrib/connectors/hp-dio/warden_client-dio.cfg
+++ b/warden3/contrib/connectors/hp-dio/warden_client-dio.cfg
@@ -1,6 +1,9 @@
{
- "warden": "warden_client.cfg",
- "name": "cz.cesnet.kryten.dionaea",
+ "warden": "warden_client.cfg",
+ "name": "cz.cesnet.server.dionaea",
+
+ "anonymised": "no",
+ "target_net": "195.113.0.0/16",
"dbfile": "/opt/dionaea/var/dionaea/logsql.sqlite",
"binaries_path" : "/opt/dionaea/var/dionaea/binaries",
@@ -8,4 +11,4 @@
"con_attempts" : 3,
"con_retry_interval" : 5,
"awin": 5
-}
\ No newline at end of file
+}