prelude-correlator/master: Automate reference of IDMEF Alert within CorrelationAlert.
[email protected] Wed, 17 Jun 2009 18:37:07 +0200 (CEST)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit 9e679501c0367a8682308fef3078c5431ba2a90d Author: Yoann Vandoorselaere <[email protected]> Date: Wed Jun 17 16:43:01 2009 +0200 Automate reference of IDMEF Alert within CorrelationAlert. Automate as much as possible reference making to IDMEF Alert into CorrelationAlert by adding a specialized 'addAlertReference()' method to the IDMEF class. Make ruleset smaller, less error prone. ======================================== PreludeCorrelator/context.py | 1 - PreludeCorrelator/idmef.py | 7 +++++++ PreludeCorrelator/plugins/bruteforce.py | 10 ++-------- PreludeCorrelator/plugins/businesshour.py | 5 +---- PreludeCorrelator/plugins/dshield.py | 5 +---- PreludeCorrelator/plugins/opensshauth.py | 5 +---- PreludeCorrelator/plugins/scan.py | 15 +++------------ PreludeCorrelator/plugins/worm.py | 5 +---- 8 files changed, 16 insertions(+), 37 deletions(-) ======================================== diff --git a/PreludeCorrelator/context.py b/PreludeCorrelator/context.py index 2970c0a..7813082 100644 --- a/PreludeCorrelator/context.py +++ b/PreludeCorrelator/context.py @@ -90,7 +90,6 @@ class Context(idmef.IDMEF, Timer): return super(Context, cls).__new__(cls) - def CheckAndDecThreshold(self): self._threshold = self._threshold - 1 if self._threshold == 0: diff --git a/PreludeCorrelator/idmef.py b/PreludeCorrelator/idmef.py index 94d6fcf..2bce617 100644 --- a/PreludeCorrelator/idmef.py +++ b/PreludeCorrelator/idmef.py @@ -109,6 +109,13 @@ class IDMEF(PreludeEasy.IDMEF): global prelude_client prelude_client.correlationAlert(self) + def addAlertReference(self, idmef): + self.Set("alert.source(>>)", idmef.Get("alert.source")) + self.Set("alert.target(>>)", idmef.Get("alert.target")) + self.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) + self.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + + def set_prelude_client(client): global prelude_client diff --git a/PreludeCorrelator/plugins/bruteforce.py b/PreludeCorrelator/plugins/bruteforce.py index 72c6af9..7d8f418 100644 --- a/PreludeCorrelator/plugins/bruteforce.py +++ b/PreludeCorrelator/plugins/bruteforce.py @@ -31,10 +31,7 @@ class BruteForcePlugin(Plugin): for source in sadd: for target in tadd: ctx = Context("BRUTE_ST_" + source + target, { "expire": 2, "threshold": 5 }, update = True) - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ctx.addAlertReference(idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.classification.text", "Brute force attack") @@ -51,10 +48,7 @@ class BruteForcePlugin(Plugin): for user in userid: ctx = Context("BRUTE_U_" + user, { "expire": 120, "threshold": 2 }, update = True) - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ctx.addAlertReference(idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.classification.text", "Brute force attack") diff --git a/PreludeCorrelator/plugins/businesshour.py b/PreludeCorrelator/plugins/businesshour.py index d450737..00fd3c0 100644 --- a/PreludeCorrelator/plugins/businesshour.py +++ b/PreludeCorrelator/plugins/businesshour.py @@ -35,10 +35,7 @@ class BusinessHourPlugin(Plugin): return ca = IDMEF() - ca.Set("alert.source", idmef.Get("alert.source")) - ca.Set("alert.target", idmef.Get("alert.target")) + ca.addAlertReference(idmef) ca.Set("alert.classification", idmef.Get("alert.classification")) - ca.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ca.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) ca.Set("alert.correlation_alert.name", "Critical system activity on day off") ca.alert() diff --git a/PreludeCorrelator/plugins/dshield.py b/PreludeCorrelator/plugins/dshield.py index 7c0dbf6..64e2774 100644 --- a/PreludeCorrelator/plugins/dshield.py +++ b/PreludeCorrelator/plugins/dshield.py @@ -78,10 +78,7 @@ class DshieldPlugin(Plugin): for source in idmef.Get("alert.source(*).node.address(*).address"): if self.__iphash.has_key(source): ca = IDMEF() - ca.Set("alert.source(>>)", idmef.Get("alert.source")) - ca.Set("alert.target(>>)", idmef.Get("alert.target")) - ca.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ca.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ca.addAlertReference(idmef) ca.Set("alert.classification.text", "IP source matching Dshield database") ca.Set("alert.correlation_alert.name", "IP source matching Dshield database") ca.Set("alert.assessment.impact.description", "Dshield gather IP addresses tagged from firewall logs drops") diff --git a/PreludeCorrelator/plugins/opensshauth.py b/PreludeCorrelator/plugins/opensshauth.py index 1872bc9..e7302e5 100644 --- a/PreludeCorrelator/plugins/opensshauth.py +++ b/PreludeCorrelator/plugins/opensshauth.py @@ -40,10 +40,7 @@ class OpenSSHAuthPlugin(Plugin): for username in idmef.Get("alert.target(*).user.user_id(*).name"): for target in idmef.Get("alert.target(*).node.address(*).address"): ctx = Context("SSH_MAT_" + target + username, {"threshold": 1}, update = True) - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ctx.addAlertReference(idmef) if not hasattr(ctx, "authtype"): ctx.authtype = data diff --git a/PreludeCorrelator/plugins/scan.py b/PreludeCorrelator/plugins/scan.py index 309ce7a..e4fc94d 100644 --- a/PreludeCorrelator/plugins/scan.py +++ b/PreludeCorrelator/plugins/scan.py @@ -34,10 +34,7 @@ class EventScanPlugin(Plugin): for saddr in source: for daddr in target: ctx = Context("SCAN_EVENTSCAN_" + saddr + daddr, { "expire": 60, "threshold": 30 }, update = True) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) + ctx.addAlertReference(idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.correlation_alert.name", "A single host has played many events against a single target. This may be a vulnerability scan") @@ -70,10 +67,7 @@ class EventSweepPlugin(Plugin): break if insert: - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ctx.addAlertReference(idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.correlation_alert.name", "A single host has played the same event against multiple targets. This may be a network scan for a specific vulnerability") @@ -96,10 +90,7 @@ class EventStormPlugin(Plugin): for saddr in source: ctx = Context("SCAN_EVENTSTORM_" + saddr, { "expire": 120, "threshold": 150 }, update = True) - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ctx.addAlertReference(idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.correlation_alert.name", "A single host is producing an unusual amount of events") diff --git a/PreludeCorrelator/plugins/worm.py b/PreludeCorrelator/plugins/worm.py index 6b90760..7609be7 100644 --- a/PreludeCorrelator/plugins/worm.py +++ b/PreludeCorrelator/plugins/worm.py @@ -43,10 +43,7 @@ class WormPlugin(Plugin): if not ctx: continue - ctx.Set("alert.source(>>)", idmef.Get("alert.source")) - ctx.Set("alert.target(>>)", idmef.Get("alert.target")) - ctx.Set("alert.correlation_alert.alertident(>>).alertident", idmef.Get("alert.messageid")) - ctx.Set("alert.correlation_alert.alertident(-1).analyzerid", idmef.Get("alert.analyzer(*).analyzerid")[-1]) + ctx.addAlertReference(idmef) # Increase and check the context threshold. if ctx.CheckAndDecThreshold(): _______________________________________________ Prelude-cvslog site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog