From f0fd2cb8f5b76369a28467c93cc1c5b7c331191a Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Fri, 28 Feb 2014 20:21:17 -0500 Subject: Add built-in Dashboard Widget for Suricata and make it persistent. --- config/suricata/suricata_alerts.widget.php | 213 +++++++++++++++++++++++++++++ 1 file changed, 213 insertions(+) create mode 100644 config/suricata/suricata_alerts.widget.php (limited to 'config/suricata/suricata_alerts.widget.php') diff --git a/config/suricata/suricata_alerts.widget.php b/config/suricata/suricata_alerts.widget.php new file mode 100644 index 00000000..fabb9314 --- /dev/null +++ b/config/suricata/suricata_alerts.widget.php @@ -0,0 +1,213 @@ + $val){ + $offset = 0; + $found = false; + foreach ($temp_array as $tmp_key => $tmp_val) { + if (!$found and strtolower($val[$subkey]) > strtolower($tmp_val[$subkey])) { + $temp_array = array_merge((array)array_slice($temp_array,0,$offset), array($key => $val), array_slice($temp_array,$offset)); + $found = true; + }; + $offset++; + }; + if (!$found) $temp_array = array_merge($temp_array, array($key => $val)); + }; + + if ($sort_ascending) { + $array = array_reverse($temp_array); + } else $array = $temp_array; + /* below is the complement for empty array test */ + return true; +}; + +/* check if firewall widget variable is set */ +$nentries = $config['widgets']['widget_suricata_display_lines']; +if (!isset($nentries) || $nentries < 0) + $nentries = 5; + +// Called by Ajax to update alerts table contents +if (isset($_GET['getNewAlerts'])) { + $response = ""; + $suri_alerts = suricata_widget_get_alerts(); + $counter = 0; + foreach ($suri_alerts as $a) { + $response .= $a['instanceid'] . " " . $a['dateonly'] . "||" . $a['timeonly'] . "||" . $a['src'] . ":" . $a['srcport'] . "||"; + $response .= $a['dst'] . ":" . $a['dstport'] . "||" . $a['priority'] . "||" . $a['category'] . "\n"; + $counter++; + if($counter >= $nentries) + break; + } + echo $response; + return; +} + +if(isset($_POST['widget_suricata_display_lines'])) { + $config['widgets']['widget_suricata_display_lines'] = $_POST['widget_suricata_display_lines']; + write_config("Saved Suricata Alerts Widget Displayed Lines Parameter via Dashboard"); + header("Location: ../../index.php"); +} + +// Read "$nentries" worth of alerts from the top of the alerts.log file +function suricata_widget_get_alerts() { + + global $config, $a_instance, $nentries; + $suricata_alerts = array(); + + /* read log file(s) */ + $counter=0; + foreach ($a_instance as $instanceid => $instance) { + $suricata_uuid = $a_instance[$instanceid]['uuid']; + $if_real = get_real_interface($a_instance[$instanceid]['interface']); + + // make sure alert file exists, then grab the most recent {$nentries} from it + // and write them to a temp file. + if (file_exists("/var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log")) { + exec("tail -{$nentries} -r /var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log > /tmp/surialerts_{$suricata_uuid}"); + if (file_exists("/tmp/surialerts_{$suricata_uuid}")) { + + /* 0 1 2 3 4 5 6 7 8 9 10 11 12 */ + /* File format: timestamp,action,sig_generator,sig_id,sig_rev,msg,classification,priority,proto,src,srcport,dst,dstport */ + $fd = fopen("/tmp/surialerts_{$suricata_uuid}", "r"); + while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) { + if(count($fields) < 12) + continue; + + // Create a DateTime object from the event timestamp that + // we can use to easily manipulate output formats. + $event_tm = date_create_from_format("m/d/Y-H:i:s.u", $fields[0]); + + // Check the 'CATEGORY' field for the text "(null)" and + // substitute "No classtype defined". + if ($fields[6] == "(null)") + $fields[6] = "No classtype assigned"; + + $suricata_alerts[$counter]['instanceid'] = strtoupper($a_instance[$instanceid]['interface']); + $suricata_alerts[$counter]['timestamp'] = strval(date_timestamp_get($event_tm)); + $suricata_alerts[$counter]['timeonly'] = date_format($event_tm, "H:i:s"); + $suricata_alerts[$counter]['dateonly'] = date_format($event_tm, "M d"); + $suricata_alerts[$counter]['src'] = inet_ntop(inet_pton($fields[9])); + $suricata_alerts[$counter]['srcport'] = $fields[10]; + $suricata_alerts[$counter]['dst'] = inet_ntop(inet_pton($fields[11])); + $suricata_alerts[$counter]['dstport'] = $fields[12]; + $suricata_alerts[$counter]['priority'] = $fields[7]; + $suricata_alerts[$counter]['category'] = $fields[6]; + $counter++; + }; + fclose($fd); + @unlink("/tmp/surialerts_{$suricata_uuid}"); + }; + }; + }; + + // Sort the alerts in descending order + sksort($suricata_alerts, 'timestamp', false); + + return $suricata_alerts; +} + +/* display the result */ +?> + + + + + + + + + + + + + + + + + + + "); + $counter++; + if($counter >= $nentries) + break; + } + } + ?> + +
IF/DateSrc/DstDetails
" . $alert['instanceid'] . " " . $alert['dateonly'] . "
" . $alert['timeonly'] . "		" . $alert['src'] . ":" . $alert['srcport'] . "
" . $alert['dst'] . ":" . $alert['dstport'] . "		Priority: " . $alert['priority'] . "
" . $alert['category'] . "
+ + + + -- cgit v1.2.3 From fde61fa3cafa4c850757d39a5c00eb631c080730 Mon Sep 17 00:00:00 2001 From: bmeeks8 Date: Mon, 3 Mar 2014 20:27:18 -0500 Subject: Fix display order issue with Suricata Dashboard Widget. --- config/suricata/suricata_alerts.widget.php | 57 +++++++++++++++++------------- 1 file changed, 32 insertions(+), 25 deletions(-) (limited to 'config/suricata/suricata_alerts.widget.php') diff --git a/config/suricata/suricata_alerts.widget.php b/config/suricata/suricata_alerts.widget.php index fabb9314..9ba502f7 100644 --- a/config/suricata/suricata_alerts.widget.php +++ b/config/suricata/suricata_alerts.widget.php @@ -3,7 +3,9 @@ suricata_alerts.widget.php Copyright (C) 2009 Jim Pingle mod 24-07-2012 - mod 28-02-2014 for use with Suricata by Bill Meeks + + Copyright (C) 2014 Bill Meeks + mod 03-Mar-2014 adapted for use with Suricata by Bill Meeks Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: @@ -67,10 +69,10 @@ function sksort(&$array, $subkey="id", $sort_ascending=false) { return true; }; -/* check if firewall widget variable is set */ -$nentries = $config['widgets']['widget_suricata_display_lines']; -if (!isset($nentries) || $nentries < 0) - $nentries = 5; +/* check if suricata widget variable is set */ +$suri_nentries = $config['widgets']['widget_suricata_display_lines']; +if (!isset($suri_nentries) || $suri_nentries < 0) + $suri_nentries = 5; // Called by Ajax to update alerts table contents if (isset($_GET['getNewAlerts'])) { @@ -81,7 +83,7 @@ if (isset($_GET['getNewAlerts'])) { $response .= $a['instanceid'] . " " . $a['dateonly'] . "||" . $a['timeonly'] . "||" . $a['src'] . ":" . $a['srcport'] . "||"; $response .= $a['dst'] . ":" . $a['dstport'] . "||" . $a['priority'] . "||" . $a['category'] . "\n"; $counter++; - if($counter >= $nentries) + if($counter >= $suri_nentries) break; } echo $response; @@ -94,10 +96,10 @@ if(isset($_POST['widget_suricata_display_lines'])) { header("Location: ../../index.php"); } -// Read "$nentries" worth of alerts from the top of the alerts.log file +// Read "$suri_nentries" worth of alerts from the top of the alerts.log file function suricata_widget_get_alerts() { - global $config, $a_instance, $nentries; + global $config, $a_instance, $suri_nentries; $suricata_alerts = array(); /* read log file(s) */ @@ -106,17 +108,17 @@ function suricata_widget_get_alerts() { $suricata_uuid = $a_instance[$instanceid]['uuid']; $if_real = get_real_interface($a_instance[$instanceid]['interface']); - // make sure alert file exists, then grab the most recent {$nentries} from it + // make sure alert file exists, then grab the most recent {$suri_nentries} from it // and write them to a temp file. if (file_exists("/var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log")) { - exec("tail -{$nentries} -r /var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log > /tmp/surialerts_{$suricata_uuid}"); + exec("tail -{$suri_nentries} -r /var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log > /tmp/surialerts_{$suricata_uuid}"); if (file_exists("/tmp/surialerts_{$suricata_uuid}")) { /* 0 1 2 3 4 5 6 7 8 9 10 11 12 */ /* File format: timestamp,action,sig_generator,sig_id,sig_rev,msg,classification,priority,proto,src,srcport,dst,dstport */ $fd = fopen("/tmp/surialerts_{$suricata_uuid}", "r"); while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) { - if(count($fields) < 12) + if(count($fields) < 13) continue; // Create a DateTime object from the event timestamp that @@ -132,9 +134,9 @@ function suricata_widget_get_alerts() { $suricata_alerts[$counter]['timestamp'] = strval(date_timestamp_get($event_tm)); $suricata_alerts[$counter]['timeonly'] = date_format($event_tm, "H:i:s"); $suricata_alerts[$counter]['dateonly'] = date_format($event_tm, "M d"); - $suricata_alerts[$counter]['src'] = inet_ntop(inet_pton($fields[9])); + $suricata_alerts[$counter]['src'] = $fields[9]; $suricata_alerts[$counter]['srcport'] = $fields[10]; - $suricata_alerts[$counter]['dst'] = inet_ntop(inet_pton($fields[11])); + $suricata_alerts[$counter]['dst'] = $fields[11]; $suricata_alerts[$counter]['dstport'] = $fields[12]; $suricata_alerts[$counter]['priority'] = $fields[7]; $suricata_alerts[$counter]['category'] = $fields[6]; @@ -146,8 +148,12 @@ function suricata_widget_get_alerts() { }; }; - // Sort the alerts in descending order - sksort($suricata_alerts, 'timestamp', false); + // Sort the alerts array + if (isset($config['syslog']['reverse'])) { + sksort($suricata_alerts, 'timestamp', false); + } else { + sksort($suricata_alerts, 'timestamp', true); + } return $suricata_alerts; } @@ -157,10 +163,8 @@ function suricata_widget_get_alerts() { @@ -183,17 +187,17 @@ var nentries = ; " . $alert['instanceid'] . " " . $alert['dateonly'] . "
" . $alert['timeonly'] . " " . $alert['src'] . ":" . $alert['srcport'] . "
" . $alert['dst'] . ":" . $alert['dstport'] . " - Priority: " . $alert['priority'] . "
" . $alert['category'] . ""); + Pri: " . $alert['priority'] . " " . $alert['category'] . ""); $counter++; - if($counter >= $nentries) + if($counter >= $suri_nentries) break; } } @@ -201,13 +205,16 @@ var nentries = ; - -- cgit v1.2.3