prelude-correlator/master: Context initialization now handle an IDMEF parameters
[email protected] Fri, 18 Dec 2009 16:58:31 +0100 (CET)
| Newsgroups | gmane.comp.security.ids.prelude.cvs |
|---|---|
| Message-ID | <[email protected]> |
commit fa87b9fb76c1bada36c07312c9e96b8ab6efbed6 Author: Yoann Vandoorselaere <[email protected]> Date: Wed Nov 4 16:31:08 2009 +0100 Context initialization now handle an IDMEF parameters If the context creation/update function is called with an IDMEF message parameter, then we automatically call addAlertReference on the context CorrelationAlert using the provided message as the parameter. ======================================== PreludeCorrelator/context.py | 24 ++++++++++++++++-------- PreludeCorrelator/plugins/bruteforce.py | 6 ++---- PreludeCorrelator/plugins/dshield.py | 7 ++----- PreludeCorrelator/plugins/firewall.py | 3 +-- PreludeCorrelator/plugins/scan.py | 9 ++------- PreludeCorrelator/plugins/worm.py | 3 +-- 6 files changed, 24 insertions(+), 28 deletions(-) ======================================== diff --git a/PreludeCorrelator/context.py b/PreludeCorrelator/context.py index 3f88348..3142867 100644 --- a/PreludeCorrelator/context.py +++ b/PreludeCorrelator/context.py @@ -18,7 +18,8 @@ # the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. import os, time, StringIO, pickle -from PreludeCorrelator import idmef, require +from PreludeCorrelator.idmef import IDMEF +from PreludeCorrelator import require _TIMER_LIST = [ ] _CONTEXT_TABLE = { } @@ -73,17 +74,21 @@ class Timer: self.start() -class Context(idmef.IDMEF, Timer): +class Context(IDMEF, Timer): def __setstate__(self, dict): Timer.__setstate__(self, dict) - idmef.IDMEF.__setstate__(self, dict) + IDMEF.__setstate__(self, dict) - def __init__(self, name, options={}, update=False): + def __init__(self, name, options={}, update=False, idmef=None): if update and _CONTEXT_TABLE.has_key(name): self._update_count += 1 + if idmef: + self.addAlertReference(idmef) + if Timer.running(self): Timer.reset(self) + return self._update_count = 0 @@ -93,14 +98,17 @@ class Context(idmef.IDMEF, Timer): self._name = name _CONTEXT_TABLE[name] = self - idmef.IDMEF.__init__(self) + IDMEF.__init__(self) Timer.__init__(self, 0) + if idmef: + self.addAlertReference(idmef) + if options.has_key("expire"): Timer.setExpire(self, options["expire"]) Timer.start(self) - def __new__(cls, name, options={}, update=False): + def __new__(cls, name, options={}, update=False, idmef=None): if update and _CONTEXT_TABLE.has_key(name): return _CONTEXT_TABLE[name] @@ -162,6 +170,6 @@ def stats(logger): now = time.time() for ctx in _CONTEXT_TABLE.values(): if not ctx._start: - logger.info("[%s]: threshold=%d" % (ctx._name, ctx._threshold)) + logger.info("[%s]: threshold=%d update=%d" % (ctx._name, ctx._threshold, ctx._update_count)) else: - logger.info("[%s]: threshold=%d expire=%d" % (ctx._name, ctx._threshold, ctx._expire - (now - ctx._start))) + logger.info("[%s]: threshold=%d update=%d expire=%d" % (ctx._name, ctx._threshold, ctx._update_count, ctx._expire - (now - ctx._start))) diff --git a/PreludeCorrelator/plugins/bruteforce.py b/PreludeCorrelator/plugins/bruteforce.py index 85cc3cc..49348f8 100644 --- a/PreludeCorrelator/plugins/bruteforce.py +++ b/PreludeCorrelator/plugins/bruteforce.py @@ -30,8 +30,7 @@ class BruteForcePlugin(Plugin): for source in sadd: for target in tadd: - ctx = Context("BRUTE_ST_" + source + target, { "expire": 2, "threshold": 5 }, update = True) - ctx.addAlertReference(idmef) + ctx = Context("BRUTE_ST_" + source + target, { "expire": 2, "threshold": 5 }, update = True, idmef = idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.classification.text", "Brute force attack") @@ -47,8 +46,7 @@ class BruteForcePlugin(Plugin): return for user in userid: - ctx = Context("BRUTE_U_" + user, { "expire": 120, "threshold": 5 }, update = True) - ctx.addAlertReference(idmef) + ctx = Context("BRUTE_U_" + user, { "expire": 120, "threshold": 5 }, update = True, idmef=idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.classification.text", "Brute force attack") diff --git a/PreludeCorrelator/plugins/dshield.py b/PreludeCorrelator/plugins/dshield.py index d77d216..be5417f 100644 --- a/PreludeCorrelator/plugins/dshield.py +++ b/PreludeCorrelator/plugins/dshield.py @@ -94,14 +94,11 @@ class DshieldPlugin(Plugin): for source in idmef.Get("alert.source(*).node.address(*).address"): entry = self.__iphash.get(source, None) if entry: - ca = context.search("DSHIELD_" + source) - if not ca: - ca = context.Context("DSHIELD_" + source, { "expire": 300, "alert_on_expire": True }, update = True) + ca = context.Context("DSHIELD_" + source, { "expire": 300, "alert_on_expire": True }, update = True, idmef = idmef) + if ca.getUpdateCount() == 0: ca.Set("alert.classification.text", "IP source matching Dshield database") ca.Set("alert.correlation_alert.name", "IP source matching Dshield database") ca.Set("alert.detect_time", entry[2] + " 00:00:00Z") ca.Set("alert.assessment.impact.description", "Dshield gathered this IP address from firewall drops logs (%s - reports: %d, attacks: %d, first/last seen: %s - %s)" % (source, entry[0], entry[1], entry[2], entry[3])) ca.Set("alert.assessment.impact.severity", "high") - ca.addAlertReference(idmef) - ca.reset() diff --git a/PreludeCorrelator/plugins/firewall.py b/PreludeCorrelator/plugins/firewall.py index d6f3f46..af7438e 100644 --- a/PreludeCorrelator/plugins/firewall.py +++ b/PreludeCorrelator/plugins/firewall.py @@ -42,8 +42,7 @@ class FirewallPlugin(Plugin): # denial is not observed in the next 10 seconds, an event alert is generated. if not context.search(ctxname): - ctx = context.Context(ctxname, { "expire": 10, "alert_on_expire": True }) + ctx = context.Context(ctxname, { "expire": 10, "alert_on_expire": True }, idmef=idmef) ctx.Set("alert.assessment", idmef.Get("alert.assessment")) ctx.Set("alert.classification", idmef.Get("alert.classification")) ctx.Set("alert.correlation_alert.name", "Events to firewall correlation") - ctx.addAlertReference(idmef) diff --git a/PreludeCorrelator/plugins/scan.py b/PreludeCorrelator/plugins/scan.py index e4fc94d..8f24600 100644 --- a/PreludeCorrelator/plugins/scan.py +++ b/PreludeCorrelator/plugins/scan.py @@ -33,9 +33,7 @@ class EventScanPlugin(Plugin): for saddr in source: for daddr in target: - ctx = Context("SCAN_EVENTSCAN_" + saddr + daddr, { "expire": 60, "threshold": 30 }, update = True) - ctx.addAlertReference(idmef) - + ctx = Context("SCAN_EVENTSCAN_" + saddr + daddr, { "expire": 60, "threshold": 30 }, update = True, idmef=idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.correlation_alert.name", "A single host has played many events against a single target. This may be a vulnerability scan") ctx.Set("alert.classification.text", "Eventscan") @@ -88,10 +86,7 @@ class EventStormPlugin(Plugin): return for saddr in source: - ctx = Context("SCAN_EVENTSTORM_" + saddr, { "expire": 120, "threshold": 150 }, update = True) - - ctx.addAlertReference(idmef) - + ctx = Context("SCAN_EVENTSTORM_" + saddr, { "expire": 120, "threshold": 150 }, update = True, idmef = idmef) if ctx.CheckAndDecThreshold(): ctx.Set("alert.correlation_alert.name", "A single host is producing an unusual amount of events") ctx.Set("alert.classification.text", "Eventstorm") diff --git a/PreludeCorrelator/plugins/worm.py b/PreludeCorrelator/plugins/worm.py index 0d45dd7..fed2ff6 100644 --- a/PreludeCorrelator/plugins/worm.py +++ b/PreludeCorrelator/plugins/worm.py @@ -40,8 +40,7 @@ class WormPlugin(Plugin): # Create context for classification combined with all the target. tlist = {} for target in idmef.Get("alert.target(*).node.address(*).address"): - ctx = context.Context("WORM_HOST_" + ctxt + target, { "expire": 300 }, update = True) - ctx.addAlertReference(idmef) + ctx = context.Context("WORM_HOST_" + ctxt + target, { "expire": 300 }, update = True, idmef = idmef) tlist[target] = True if not hasattr(ctx, "_target_list"): _______________________________________________ Prelude-cvslog site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-cvslog