Re: colors?

Steve Koh <[email protected]> Mon, 07 Apr 2003 03:30:30 +0900
Newsgroups gmane.comp.security.ids.snort.snarf
Message-ID <[email protected]>
This is a multi-part message in MIME format.
--------------040804040206050108070409
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

James,

I can say that at least one of the other RCERTs happens to prefer the 
snortsnarf color scheme and have adapted it to a number of our other 
data analysis pages.  It's really easy on the eyes. Thanks for your hard 
work.

Attached is a patch with our mods to HTMLOutput.pm for:
1 - higher split_thresh
2 - htmlize the SCRIPT tag that shows up in some rules
3 - a whois lookup for KRNIC, though they are usually down in the middle 
of the night, Korea time
4 - a link back to an index page (we build our own summary page based on 
snort alerts and portscan.logs)

Regards,
-Steve

James Hoagland wrote:

>
> Joel,
>
> At 9:00 AM -0500 4/4/03, Esler, Joel  Contractor wrote:
>
>>  I've looked all over, however, maybe one of ya'll can help me out with
>>  this one...
>>
>>  Snort Snarf, while it may be a great tool, the webpage itself is a bit
>>  lacking (creativity wise)..  Would like to customize the actual 
>> colors and
>>  such of the html, where is this found?
>
>
> Throughout HTMLOutput.pm. I'd be interested in seeing what you come up 
> with.
>
> Best regards,
>
>   Jim



--------------040804040206050108070409
Content-Type: text/html;
 name="HTMLOutput.pm.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="HTMLOutput.pm.patch"

--- HTMLOutput.pm.orig	2003-04-07 03:08:07.000000000 +0900
+++ HTMLOutput.pm	2003-04-07 03:11:41.000000000 +0900
@@ -33,7 +33,7 @@
         'color_opt' => 'rotate', # the color option
         'cgi_dir' => '/cgi-bin', # cgi directory
         'db_file' => '', # annotations database file
-        'split_thresh' => 100, # threshold for splitting long alert listings to multiple pages
+        'split_thresh' => 1000, # threshold for splitting long alert listings to multiple pages
         'topquant' => 20, # number of IPs to list in list of top ones
         'nmap_dir' => undef, # the file directory containing nmap2html pages
         'nmap_url' => undef, # the URL prefix for nmap2html pages
@@ -650,6 +650,7 @@
             if (@rules_html) {
                 print "<tr bgcolor=\"#D5E2CE\"><td colspan=3 align=center>Rules with message \"",$self->{'sightml'}{$sig},"\":</td></tr>\n";
                 foreach (@rules_html) {
+		    s/<SCRIPT>/&lt;SCRIPT&gt;/; # added so that SCRIPT isn't interpreted on rules page.
                     print "<tr bgcolor=\"#D5E2CE\"><td colspan=3 align=left>$_</td></tr>\n";
                 }
             }
@@ -1542,6 +1543,8 @@
                 "?searchtext=$ip\"$target>RIPE</a></td>\n";
     print "<td><a href=\"http://www.apnic.net/apnic-bin/whois.pl".
                 "?search=$ip\"$target>APNIC</a></td>\n";
+    print "<td><a href=\"http://whois.nic.or.kr/whois/webapisvc". 
+                "?VALUE=$ip\"$target>KRNIC</a></td>\n";
     print "<td><a href=\"http://www.geektools.com/cgi-bin/proxy.cgi".
                     "?query=$ip&targetnic=auto\"$target>Geektools</a></td>\n";
                     # thanks to Dr. Paul Mitchell for this add
@@ -1580,7 +1583,8 @@
     print "</head>\n<body BGCOLOR=\"".$self->{'cur'}{'bgcol'}."\">\n";
     print "<table><tr>\n";
     print "<td width=130><A HREF=\"http://www.silicondefense.com/\"><IMG BORDER=0 width=123 height=72 SRC=\"".$self->{'cur'}{'base'}.$self->{'cur'}{'topbase'}.$logo_filename."\" ALT=\"[Silicon Defense logo]\"></A></td>\n";
-    print "<td><CENTER><h1>SnortSnarf $page_type</h1><h2>$page_h2</h2>$self->{'prog_line'}</CENTER></td></tr></table><hr>\n";
+    print "<td><CENTER><h1>SnortSnarf $page_type</h1><h2>$page_h2</h2>$self->{'prog_line'}<p>\n"; 
+    print "<a href=\"/index.html\">Start Page</a></CENTER></td></tr></table><hr>\n";
     print "\n\n";
     $self->print_top_nav_links();
 }

--------------040804040206050108070409--