A script for automating sending suricata alerts via email.

suricata-alert-mail.pl

#!/usr/bin/env perl
use strict;
#
# Script for parsing json data from suricata-eve log lines and mailing them to
# the configured email address.
#
# Exit Codes:
#   0  - success
#   >0 - failure
#
#===============================================================================
# MIT License
#
# Copyright (c) 2020 Jeremy Cliff Armstrong
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.
#===============================================================================

my $to_addr   = 'sysadmin@example.net';
my $from_addr = 'tiphares@example.net';
my $host      = 'Tiphares';

my $smtp_host = 'mx.example.net';
my $username  = $from_addr;
my $password  = '1ieLD!0F^S@H';

##################
## BEGIN SCRIPT ##
##################
use v5.6.0;
use JSON::MaybeXS;
use MIME::Lite::TT;
use Net::SMTP;
use Authen::SASL;
use DateTime::Format::ISO8601;
#use Data::Dump;

my $arguments = join(' ', @ARGV);
$arguments =~ s/\\//g;
$arguments =~ s/^.*\@cee:\s\{/\{/;

my $json_data = decode_json($arguments);
my $signature = $json_data->{alert}{signature};
my $category  = $json_data->{alert}{category};

my $tempdate = $json_data->{timestamp};
$tempdate    =~ s/\.\d{6}//;
$tempdate    =~ s/([\-\+]\d\d)(\d\d)/$1:$2/;
my $dt       = DateTime::Format::ISO8601->parse_datetime($tempdate);

my $json_pp = JSON::MaybeXS->new(utf8 => 1, pretty => 1)->encode($json_data);

my $template = <<TEMPLATE;
An Alert was triggered on [% host %]:

Source IP:       [% source %]
Destination IP:  [% destination %]

Rule ID:           [% ruleid %]
Rule Description:  [% ruledesc %]
Rule Category:     [% rulecat %]

Time & Date: [% time %]

==== Full JSON ====

[% jsonpp %]

TEMPLATE

my %params  = (
    host        => $host,
    source      => $json_data->{src_ip},
    destination => $json_data->{dest_ip},
    ruleid      => $json_data->{alert}{signature_id},
    ruledesc    => $signature,
    rulecat     => $category,
    time        => join('',
            $dt->hour_12(), ':', sprintf("%02d", $dt->minute()),
            $dt->am_or_pm(), ', ', $dt->month_name(), ' ', $dt->day(), ', ',
            $dt->year
        ),
    jsonpp      => $json_pp
);
my %options = (
    EVAL_PERL => 1
);
my $msg     = MIME::Lite::TT->new(
    From        => $from_addr,
    To          => $to_addr,
    Subject     => join('',
            'Suricata Alert @ ', $host, ': ', $category, '/',
            $signature
        ),
    Template    => \$template,
    TmplParams  => \%params,
    TmplOptions => \%options
);

#ddx($msg);

my $sasl = Authen::SASL->new(
    mechanism => 'PLAIN LOGIN',
    callback  => { user => $username, pass => $password }
);


my $smtp = Net::SMTP->new(
    $smtp_host,
    Port  => 587,
    #SendHello => 0,
    Hello => 'tiphares.example.net',
    Debug => 1,
) or die "Can't connect.";
$smtp->starttls()                 or die "Error:\n".$smtp->message();
$smtp->auth($sasl)                or die "Can't Authenticate:\n".$smtp->message()."\n".$sasl->error();
$smtp->mail($from_addr)           or die "Error:\n".$smtp->message();
$smtp->to($to_addr)               or die "Error:\n".$smtp->message();
$smtp->data()                     or die "Error:\n".$smtp->message();
$smtp->datasend($msg->as_string)  or die "Error:\n".$smtp->message();
$smtp->datasend()                 or die "Error:\n".$smtp->message();
$smtp->quit()                     or die "Error:\n".$smtp->message();