Skip to content

Instantly share code, notes, and snippets.

@hillar
Created February 2, 2017 13:54
Show Gist options
  • Save hillar/d721f0e98bc748b90108cb162fbc14c7 to your computer and use it in GitHub Desktop.
Save hillar/d721f0e98bc748b90108cb162fbc14c7 to your computer and use it in GitHub Desktop.
read suricata alerts from syslog and send to xmpp MUC
"""
/etc/suricata/suricata.yaml
...
# Extensible Event Format (nicknamed EVE) event log in JSON format
- eve-log:
enabled: yes
filetype: syslog
filename: eve.json
prefix: "@cee: "
# the following are valid when type: syslog above
identity: "suricata"
facility: local5
level: Info
...
------
# tail -f /var/log/syslog | grep signature
2017-02-02T13:41:23.948224+00:00 suricata.yellow.ex suricata[5123]: @cee: {"timestamp":"2017-02-02T13:41:23.948080+0000","flow_id":583985478663394,"in_iface":"eth2","event_type":"alert","vlan":3603,"src_ip":"2a07:1181:0130:3603:0000:0000:0000:0004","src_port":42188,"dest_ip":"2a07:1181:0130:3607:0000:0000:0000:0002","dest_port":22,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2001219,"rev":20,"signature":"ET SCAN Potential SSH Scan","category":"Attempted Information Leak","severity":2}}
"""
from abusehelper.core import bot, events
from abusehelper.bots.tailbot.tailbot import TailBot
import json
class SuricataInSyslogBot(TailBot):
path = bot.Param("syslog file path")
def parse(self, line, _):
line = line.strip()
if not line:
return
pos = line.find("]: @cee: {")
try:
j = json.loads(line[pos+9:])
except ValueError:
return
if j['event_type'] == "alert":
facts = dict()
facts['timestamp'] = j['timestamp']
facts['vlan'] = j['vlan']
facts['src_ip'] = j['src_ip']
facts['dest_ip'] = j['dest_ip']
facts['alert'] = j['alert']['signature']
return events.Event(facts)
return
if __name__ == "__main__":
SuricataInSyslogBot.from_command_line().execute()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment