From abcbe4f90a068074018a736cb6f63d09de30c3f2 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Wed, 25 Sep 2013 17:36:42 -0400 Subject: Add reverse DNS lookup icon and fix dup Suppress List bug --- config/snort/snort_alerts.php | 49 +++++++++++++++++++++++++++---------------- 1 file changed, 31 insertions(+), 18 deletions(-) (limited to 'config/snort/snort_alerts.php') diff --git a/config/snort/snort_alerts.php b/config/snort/snort_alerts.php index 9082aaeb..0295ed2f 100755 --- a/config/snort/snort_alerts.php +++ b/config/snort/snort_alerts.php @@ -90,8 +90,8 @@ function snort_add_supplist_entry($suppress) { /* If no Suppress List is set for the interface, then create one with the interface name */ if (empty($a_instance[$instanceid]['suppresslistname']) || $a_instance[$instanceid]['suppresslistname'] == 'default') { $s_list = array(); - $s_list['name'] = $a_instance[$instanceid]['interface'] . "suppress"; $s_list['uuid'] = uniqid(); + $s_list['name'] = $a_instance[$instanceid]['interface'] . "suppress" . "_" . $s_list['uuid']; $s_list['descr'] = "Auto-generated list for Alert suppression"; $s_list['suppresspassthru'] = base64_encode($suppress); $a_suppress[] = $s_list; @@ -247,7 +247,6 @@ if ($_POST['download']) { readfile("$file"); @unlink("/tmp/{$file_name}"); } - header("Location: /snort/snort_alerts.php?instance={$instanceid}"); exit; } @@ -267,7 +266,7 @@ include_once("fbegin.inc"); /* refresh every 60 secs */ if ($pconfig['arefresh'] == 'on') - echo "\n"; + echo "\n"; ?> ' . $pgtitle . '

';} @@ -304,7 +303,7 @@ if ($pconfig['arefresh'] == 'on') - $instance) { $selected = ""; @@ -400,19 +399,26 @@ if (file_exists("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert")) { $alert_ip_src = $fields[6]; /* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */ $alert_ip_src = str_replace(":", ":​", $alert_ip_src); + /* Add Reverse DNS lookup icon */ + $alert_ip_src .= "
"; + $alert_ip_src .= ""; + /* Add icons for auto-adding to Suppress List if appropriate */ if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2]) && !isset($supplist[$fields[1]][$fields[2]]['by_src'][$fields[6]])) { - $alert_ip_src .= "
"; + $alert_ip_src .= "  "; $alert_ip_src .= ""; + $alert_ip_src .= "title='" . gettext("Add this alert to the Suppress List and track by_src IP") . "'>"; } elseif (isset($supplist[$fields[1]][$fields[2]]['by_src'][$fields[6]])) { - $alert_ip_src .= "
"; + $alert_ip_src .= "  "; } + /* Add icon for auto-removing from Blocked Table if required */ if (isset($tmpblocked[$fields[6]])) { - $alert_ip_src .= "   - \"Remove"; + $alert_ip_src .= " "; + $alert_ip_src .= " + \"Remove"; } /* IP SRC Port */ $alert_src_p = $fields[7]; @@ -420,19 +426,26 @@ if (file_exists("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert")) { $alert_ip_dst = $fields[8]; /* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */ $alert_ip_dst = str_replace(":", ":​", $alert_ip_dst); + /* Add Reverse DNS lookup icon */ + $alert_ip_dst .= "
"; + $alert_ip_dst .= ""; + /* Add icons for auto-adding to Suppress List if appropriate */ if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2]) && !isset($supplist[$fields[1]][$fields[2]]['by_dst'][$fields[8]])) { - $alert_ip_dst .= "
"; + $alert_ip_dst .= "  "; $alert_ip_dst .= ""; + $alert_ip_dst .= "title='" . gettext("Add this alert to the Suppress List and track by_dst IP") . "'>"; } elseif (isset($supplist[$fields[1]][$fields[2]]['by_dst'][$fields[8]])) { - $alert_ip_dst .= "
"; + $alert_ip_dst .= "  "; } + /* Add icon for auto-removing from Blocked Table if required */ if (isset($tmpblocked[$fields[8]])) { - $alert_ip_dst .= "   - \"Remove"; + $alert_ip_dst .= " "; + $alert_ip_dst .= " + \"Remove"; } /* IP DST Port */ $alert_dst_p = $fields[9]; @@ -441,11 +454,11 @@ if (file_exists("/var/log/snort/snort_{$if_real}{$snort_uuid}/alert")) { if (!snort_is_alert_globally_suppressed($supplist, $fields[1], $fields[2])) { $sidsupplink = ""; $sidsupplink .= ""; + $sidsupplink .= "title='" . gettext("Add this alert to the Suppress List") . "'>"; } else { $sidsupplink = ""; + $sidsupplink .= "title='" . gettext("This alert is already in the Suppress List") . "'/>"; } $alert_class = $fields[11]; -- cgit v1.2.3