prelude-correlator/master: Dshield plugin fixes

commit 44b54ff1ad6ce7a2f5b78e32dc7ee6c1587e3d37
Author: Yoann Vandoorselaere <[email protected]>
Date:   Mon Jul 6 10:15:27 2009 +0200

    Dshield plugin fixes
    
    The dshield plugin didn't report any events since address loaded
    from the DSHIELD database weren't correctly normalized.
    
    This also fixes reloading of the DShield database, which was not
    working in previous version due to the timer not being started.
    
    Additionally, generated alerts now include additional details.


========================================

 PreludeCorrelator/plugins/dshield.py |   21 +++++++++++++++------
 1 files changed, 15 insertions(+), 6 deletions(-)

========================================

diff --git a/PreludeCorrelator/plugins/dshield.py b/PreludeCorrelator/plugins/dshield.py
index 80442fc..ba6620b 100644
--- a/PreludeCorrelator/plugins/dshield.py
+++ b/PreludeCorrelator/plugins/dshield.py
@@ -31,16 +31,23 @@ class DshieldPlugin(Plugin):
     DSHIELD_URI = "/ipsascii.html?limit=10000"
     DSHIELD_TIMEOUT = 10
 
+    def __ipNormalize(self, ip):
+        return ".".join([ i.lstrip("0") for i in ip.split(".") ])
+
     def __loadData(self, fname, age=0):
         cnt = 0
         self.__iphash.clear()
 
         for line in open(fname, "r"):
-            if line[0] != '#':
-                self.__iphash[line.split('\t')[0]] = True
-                cnt = cnt + 1
+            if line[0] == '#':
+                continue
+
+            ip, reports, attacks, first_seen, last_seen = line.split('\t')
+            self.__iphash[self.__ipNormalize(ip)] = (int(reports), int(attacks), first_seen, last_seen)
+
+            cnt = cnt + 1
 
-        Timer(self.__reload - age, self.__retrieveData)
+        Timer(self.__reload - age, self.__retrieveData).start()
 
     def __retrieveData(self, timer=None):
         fname = siteconfig.lib_dir + "/dshield.dat"
@@ -80,11 +87,13 @@ class DshieldPlugin(Plugin):
 
     def run(self, idmef):
         for source in idmef.Get("alert.source(*).node.address(*).address"):
-            if self.__iphash.has_key(source):
+            entry = self.__iphash.get(source, None)
+            if entry:
                 ca = IDMEF()
                 ca.addAlertReference(idmef)
                 ca.Set("alert.classification.text", "IP source matching Dshield database")
                 ca.Set("alert.correlation_alert.name", "IP source matching Dshield database")
-                ca.Set("alert.assessment.impact.description", "Dshield gather IP addresses tagged from firewall logs drops")
+                ca.Set("alert.detect_time", entry[2] + " 00:00:00Z")
+                ca.Set("alert.assessment.impact.description", "Dshield gathered this IP address from firewall drops logs (%s - reports: %d, attacks: %d, first/last seen: %s - %s)" % (source, entry[0], entry[1], entry[2], entry[3]))
                 ca.Set("alert.assessment.impact.severity", "high")
                 ca.alert()
_______________________________________________
Prelude-cvslog site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog