Re: colors?
Steve Koh <[email protected]> Mon, 07 Apr 2003 03:30:30 +0900
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------040804040206050108070409
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
James,
I can say that at least one of the other RCERTs happens to prefer the
snortsnarf color scheme and have adapted it to a number of our other
data analysis pages. It's really easy on the eyes. Thanks for your hard
work.
Attached is a patch with our mods to HTMLOutput.pm for:
1 - higher split_thresh
2 - htmlize the SCRIPT tag that shows up in some rules
3 - a whois lookup for KRNIC, though they are usually down in the middle
of the night, Korea time
4 - a link back to an index page (we build our own summary page based on
snort alerts and portscan.logs)
Regards,
-Steve
James Hoagland wrote:
>
> Joel,
>
> At 9:00 AM -0500 4/4/03, Esler, Joel Contractor wrote:
>
>> I've looked all over, however, maybe one of ya'll can help me out with
>> this one...
>>
>> Snort Snarf, while it may be a great tool, the webpage itself is a bit
>> lacking (creativity wise).. Would like to customize the actual
>> colors and
>> such of the html, where is this found?
>
>
> Throughout HTMLOutput.pm. I'd be interested in seeing what you come up
> with.
>
> Best regards,
>
> Jim
--------------040804040206050108070409
Content-Type: text/html;
name="HTMLOutput.pm.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
filename="HTMLOutput.pm.patch"
--- HTMLOutput.pm.orig 2003-04-07 03:08:07.000000000 +0900
+++ HTMLOutput.pm 2003-04-07 03:11:41.000000000 +0900
@@ -33,7 +33,7 @@
'color_opt' => 'rotate', # the color option
'cgi_dir' => '/cgi-bin', # cgi directory
'db_file' => '', # annotations database file
- 'split_thresh' => 100, # threshold for splitting long alert listings to multiple pages
+ 'split_thresh' => 1000, # threshold for splitting long alert listings to multiple pages
'topquant' => 20, # number of IPs to list in list of top ones
'nmap_dir' => undef, # the file directory containing nmap2html pages
'nmap_url' => undef, # the URL prefix for nmap2html pages
@@ -650,6 +650,7 @@
if (@rules_html) {
print "<tr bgcolor=\"#D5E2CE\"><td colspan=3 align=center>Rules with message \"",$self->{'sightml'}{$sig},"\":</td></tr>\n";
foreach (@rules_html) {
+ s/<SCRIPT>/<SCRIPT>/; # added so that SCRIPT isn't interpreted on rules page.
print "<tr bgcolor=\"#D5E2CE\"><td colspan=3 align=left>$_</td></tr>\n";
}
}
@@ -1542,6 +1543,8 @@
"?searchtext=$ip\"$target>RIPE</a></td>\n";
print "<td><a href=\"http://www.apnic.net/apnic-bin/whois.pl".
"?search=$ip\"$target>APNIC</a></td>\n";
+ print "<td><a href=\"http://whois.nic.or.kr/whois/webapisvc".
+ "?VALUE=$ip\"$target>KRNIC</a></td>\n";
print "<td><a href=\"http://www.geektools.com/cgi-bin/proxy.cgi".
"?query=$ip&targetnic=auto\"$target>Geektools</a></td>\n";
# thanks to Dr. Paul Mitchell for this add
@@ -1580,7 +1583,8 @@
print "</head>\n<body BGCOLOR=\"".$self->{'cur'}{'bgcol'}."\">\n";
print "<table><tr>\n";
print "<td width=130><A HREF=\"http://www.silicondefense.com/\"><IMG BORDER=0 width=123 height=72 SRC=\"".$self->{'cur'}{'base'}.$self->{'cur'}{'topbase'}.$logo_filename."\" ALT=\"[Silicon Defense logo]\"></A></td>\n";
- print "<td><CENTER><h1>SnortSnarf $page_type</h1><h2>$page_h2</h2>$self->{'prog_line'}</CENTER></td></tr></table><hr>\n";
+ print "<td><CENTER><h1>SnortSnarf $page_type</h1><h2>$page_h2</h2>$self->{'prog_line'}<p>\n";
+ print "<a href=\"/index.html\">Start Page</a></CENTER></td></tr></table><hr>\n";
print "\n\n";
$self->print_top_nav_links();
}
--------------040804040206050108070409--