[PATCH] Configurable Hours / Days in BusinessHourPlugin (prelude-correlator) - With inline body patches

It seems that my attachments have gone in my previous mail, sorry.

businesshour.py.diff : 

--- /home/laotseu/businesshour.py.orig  2010-01-07 09:59:06.000000000
+0100
+++ businesshour.py     2010-01-07 12:17:37.000000000 +0100
@@ -1,5 +1,6 @@
 # Copyright (C) 2009 PreludeIDS Technologies. All Rights Reserved.
 # Author: Yoann Vandoorselaere <[email protected]>
+# Author: Alexandre De Dommelin <[email protected]>
 #
 # This file is part of the Prelude-Correlator program.
 #
@@ -21,14 +22,26 @@
 from PreludeCorrelator.idmef import IDMEF
 from PreludeCorrelator.pluginmanager import Plugin
 
-# Alert only on saturday and sunday, and everyday from 6:00pm to 9:00am.
+# By default, alert only on saturday and sunday, and everyday from 6:00pm
to 9:00am.
 
 class BusinessHourPlugin(Plugin):
-    def run(self, idmef):
+    BUSINESSHOUR_HWORKSTART = 9
+    BUSINESSHOUR_HWORKEND = 17
+    BUSINESSHOUR_OFFDAYS = '[5,6]'
+
+    def __init__(self,env):
+        Plugin.__init__(self, env)
+
+        self.__hworkstart = int(self.getConfigValue("hworkstart",
self.BUSINESSHOUR_HWORKSTART))
+        self.__hworkend = int(self.getConfigValue("hworkend",
self.BUSINESSHOUR_HWORKEND))
+        self.__offdays = eval(self.getConfigValue("offdays",
self.BUSINESSHOUR_OFFDAYS))
+
 
-        t = time.localtime(int(idmef.Get("alert.create_time")))
 
-        if not (t.tm_wday == 5 or t.tm_wday == 6 or t.tm_hour < 9 or
t.tm_hour > 17):
+    def run(self, idmef):
+        self.__t = time.localtime(int(idmef.Get("alert.create_time")))
+
+        if not (self.__t.tm_wday in self.__offdays or self.__t.tm_hour <
self.__hworkstart or self.__t.tm_hour > self.__hworkend):
                 return
 
         if idmef.Get("alert.assessment.impact.completion") !=
"succeeded":
@@ -38,4 +51,5 @@
         ca.addAlertReference(idmef)
         ca.Set("alert.classification", idmef.Get("alert.classification"))
         ca.Set("alert.correlation_alert.name", "Critical system activity
on day off")
+
         ca.alert()






prelude-correlator.conf.diff : 




--- prelude-correlator.conf.orig        2010-01-07 12:21:21.000000000
+0100
+++ prelude-correlator.conf     2010-01-07 12:22:53.000000000 +0100
@@ -4,6 +4,10 @@
 # disable = false
 #
 # [BusinessHourPlugin]
+# By default, the plugin alerts only on saturday and sunday, and everyday
from 6:00pm to 9:00a
+# hworkstart = 9
+# hworkend = 17
+# offdays = [5,6]
 # disable = false
 #
 # [OpenSSHAuthPlugin]




-- 
 ,'' `. Alexandre DE DOMMELIN | pgp: 0xF8374166 
 : :' : irc: laotseu
 . `'
 `-

_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel