suppression entry text */ /* */ /* Returns: */ /* TRUE if successful or FALSE on failure */ /************************************************/ global $config, $a_instance, $instanceid; if (!is_array($config['installedpackages']['suricata']['suppress'])) $config['installedpackages']['suricata']['suppress'] = array(); if (!is_array($config['installedpackages']['suricata']['suppress']['item'])) $config['installedpackages']['suricata']['suppress']['item'] = array(); $a_suppress = &$config['installedpackages']['suricata']['suppress']['item']; $found_list = false; /* If no Suppress List is set for the interface, then create one with the interface name */ if (empty($a_instance[$instanceid]['suppresslistname']) || $a_instance[$instanceid]['suppresslistname'] == 'default') { $s_list = array(); $s_list['uuid'] = uniqid(); $s_list['name'] = $a_instance[$instanceid]['interface'] . "suppress" . "_" . $s_list['uuid']; $s_list['descr'] = "Auto-generated list for Alert suppression"; $s_list['suppresspassthru'] = base64_encode($suppress); $a_suppress[] = $s_list; $a_instance[$instanceid]['suppresslistname'] = $s_list['name']; $found_list = true; } else { /* If we get here, a Suppress List is defined for the interface so see if we can find it */ foreach ($a_suppress as $a_id => $alist) { if ($alist['name'] == $a_instance[$instanceid]['suppresslistname']) { $found_list = true; if (!empty($alist['suppresspassthru'])) { $tmplist = base64_decode($alist['suppresspassthru']); $tmplist .= "\n{$suppress}"; $alist['suppresspassthru'] = base64_encode($tmplist); $a_suppress[$a_id] = $alist; } else { $alist['suppresspassthru'] = base64_encode($suppress); $a_suppress[$a_id] = $alist; } } } } /* If we created a new list or updated an existing one, save the change, */ /* tell Snort to load it, and return true; otherwise return false. */ if ($found_list) { write_config(); sync_suricata_package_config(); suricata_reload_config($a_instance[$instanceid]); return true; } else return false; } if ($_POST['instance']) $instanceid = $_POST['instance']; // This is for the auto-refresh so wecan stay on the same interface if (is_numeric($_GET['instance'])) $instanceid = $_GET['instance']; if (empty($instanceid)) $instanceid = 0; if (!is_array($config['installedpackages']['suricata']['rule'])) $config['installedpackages']['suricata']['rule'] = array(); $a_instance = &$config['installedpackages']['suricata']['rule']; $suricata_uuid = $a_instance[$instanceid]['uuid']; $if_real = get_real_interface($a_instance[$instanceid]['interface']); $suricatalogdir = SURICATALOGDIR; // Load up the arrays of force-enabled and force-disabled SIDs $enablesid = suricata_load_sid_mods($a_instance[$instanceid]['rule_sid_on']); $disablesid = suricata_load_sid_mods($a_instance[$instanceid]['rule_sid_off']); $pconfig = array(); if (is_array($config['installedpackages']['suricata']['alertsblocks'])) { $pconfig['arefresh'] = $config['installedpackages']['suricata']['alertsblocks']['arefresh']; $pconfig['alertnumber'] = $config['installedpackages']['suricata']['alertsblocks']['alertnumber']; } if (empty($pconfig['alertnumber'])) $pconfig['alertnumber'] = '250'; if (empty($pconfig['arefresh'])) $pconfig['arefresh'] = 'off'; $anentries = $pconfig['alertnumber']; if ($_POST['save']) { if (!is_array($config['installedpackages']['suricata']['alertsblocks'])) $config['installedpackages']['suricata']['alertsblocks'] = array(); $config['installedpackages']['suricata']['alertsblocks']['arefresh'] = $_POST['arefresh'] ? 'on' : 'off'; $config['installedpackages']['suricata']['alertsblocks']['alertnumber'] = $_POST['alertnumber']; write_config(); header("Location: /suricata/suricata_alerts.php?instance={$instanceid}"); exit; } //if ($_POST['unblock'] && $_POST['ip']) { // if (is_ipaddr($_POST['ip'])) { // exec("/sbin/pfctl -t snort2c -T delete {$_POST['ip']}"); // $savemsg = gettext("Host IP address {$_POST['ip']} has been removed from the Blocked Table."); // } //} if (($_POST['addsuppress_srcip'] || $_POST['addsuppress_dstip'] || $_POST['addsuppress']) && is_numeric($_POST['sidid']) && is_numeric($_POST['gen_id'])) { if ($_POST['addsuppress_srcip']) $method = "by_src"; elseif ($_POST['addsuppress_dstip']) $method = "by_dst"; else $method ="all"; // See which kind of Suppress Entry to create switch ($method) { case "all": if (empty($_POST['descr'])) $suppress = "suppress gen_id {$_POST['gen_id']}, sig_id {$_POST['sidid']}\n"; else $suppress = "#{$_POST['descr']}\nsuppress gen_id {$_POST['gen_id']}, sig_id {$_POST['sidid']}\n"; $success = gettext("An entry for 'suppress gen_id {$_GET['gen_id']}, sig_id {$_GET['sidid']}' has been added to the Suppress List."); break; case "by_src": case "by_dst": // Check for valid IP addresses, exit if not valid if (is_ipaddr($_POST['ip']) || is_ipaddrv6($_POST['ip'])) { if (empty($_POST['descr'])) $suppress = "suppress gen_id {$_POST['gen_id']}, sig_id {$_POST['sidid']}, track {$method}, ip {$_POST['ip']}\n"; else $suppress = "#{$_POST['descr']}\nsuppress gen_id {$_POST['gen_id']}, sig_id {$_POST['sidid']}, track {$method}, ip {$_POST['ip']}\n"; $success = gettext("An entry for 'suppress gen_id {$_POST['gen_id']}, sig_id {$_POST['sidid']}, track {$method}, ip {$_POST['ip']}' has been added to the Suppress List."); } else { header("Location: /suricata/suricata_alerts.php"); exit; } break; default: header("Location: /suricata/suricata_alerts.php"); exit; } /* Add the new entry to the Suppress List and signal Suricata to reload config */ if (suricata_add_supplist_entry($suppress)) { suricata_reload_config($a_instance[$instanceid]); $savemsg = $success; } else $input_errors[] = gettext("Suppress List '{$a_instance[$instanceid]['suppresslistname']}' is defined for this interface, but it could not be found!"); } if ($_POST['togglesid'] && is_numeric($_POST['sidid']) && is_numeric($_POST['gen_id'])) { // Get the GID and SID tags embedded in the clicked rule icon. $gid = $_POST['gen_id']; $sid= $_POST['sidid']; // See if the target SID is in our list of modified SIDs, // and toggle it if present. if (isset($enablesid[$gid][$sid])) unset($enablesid[$gid][$sid]); if (isset($disablesid[$gid][$sid])) unset($disablesid[$gid][$sid]); elseif (!isset($disablesid[$gid][$sid])) $disablesid[$gid][$sid] = "disablesid"; // Write the updated enablesid and disablesid values to the config file. $tmp = ""; foreach (array_keys($enablesid) as $k1) { foreach (array_keys($enablesid[$k1]) as $k2) $tmp .= "{$k1}:{$k2}||"; } $tmp = rtrim($tmp, "||"); if (!empty($tmp)) $a_instance[$instanceid]['rule_sid_on'] = $tmp; else unset($a_instance[$instanceid]['rule_sid_on']); $tmp = ""; foreach (array_keys($disablesid) as $k1) { foreach (array_keys($disablesid[$k1]) as $k2) $tmp .= "{$k1}:{$k2}||"; } $tmp = rtrim($tmp, "||"); if (!empty($tmp)) $a_instance[$instanceid]['rule_sid_off'] = $tmp; else unset($a_instance[$instanceid]['rule_sid_off']); /* Update the config.xml file. */ write_config(); /*************************************************/ /* Update the suricata.yaml file and rebuild the */ /* rules for this interface. */ /*************************************************/ $rebuild_rules = true; suricata_generate_yaml($a_instance[$instanceid]); $rebuild_rules = false; /* Signal Suricata to live-load the new rules */ suricata_reload_config($a_instance[$instanceid]); $savemsg = gettext("The state for rule {$gid}:{$sid} has been modified. Suricata is 'live-reloading' the new rules list. Please wait at least 30 secs for the process to complete before toggling additional rules."); } if ($_POST['delete']) { suricata_post_delete_logs($suricata_uuid); $fd = @fopen("{$suricatalogdir}suricata_{$if_real}{$suricata_uuid}/alerts.log", "w+"); if ($fd) fclose($fd); /* XXX: This is needed if suricata is run as suricata user */ mwexec('/bin/chmod 660 {$suricatalogdir}*', true); header("Location: /suricata/suricata_alerts.php?instance={$instanceid}"); exit; } if ($_POST['download']) { $save_date = exec('/bin/date "+%Y-%m-%d-%H-%M-%S"'); $file_name = "suricata_logs_{$save_date}_{$if_real}.tar.gz"; exec("cd {$suricatalogdir}suricata_{$if_real}{$suricata_uuid} && /usr/bin/tar -czf /tmp/{$file_name} *"); if (file_exists("/tmp/{$file_name}")) { ob_start(); //important or other posts will fail if (isset($_SERVER['HTTPS'])) { header('Pragma: '); header('Cache-Control: '); } else { header("Pragma: private"); header("Cache-Control: private, must-revalidate"); } header("Content-Type: application/octet-stream"); header("Content-length: " . filesize("/tmp/{$file_name}")); header("Content-disposition: attachment; filename = {$file_name}"); ob_end_clean(); //important or other post will fail readfile("/tmp/{$file_name}"); // Clean up the temp file @unlink("/tmp/{$file_name}"); } else $savemsg = gettext("An error occurred while creating archive"); } /* Load up an array with the current Suppression List GID,SID values */ $supplist = suricata_load_suppress_sigs($a_instance[$instanceid], true); $pgtitle = gettext("Suricata: Alerts"); include_once("head.inc"); ?> \n"; ?>
  
  
> ', '', '', ''); ?>   ', '', '', ''); ?>
  
/tmp/alerts_suricata{$suricata_uuid}"); if (file_exists("/tmp/alerts_suricata{$suricata_uuid}")) { $tmpblocked = array_flip(suricata_get_blocked_ips()); $counter = 0; /* 0 1 2 3 4 5 6 7 8 9 10 11 12 */ /* File format timestamp,action,sig_generator,sig_id,sig_rev,msg,classification,priority,proto,src,srcport,dst,dstport */ $fd = fopen("/tmp/alerts_suricata{$suricata_uuid}", "r"); while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) { if(count($fields) < 12) continue; // Create a DateTime object from the event timestamp that // we can use to easily manipulate output formats. $event_tm = date_create_from_format("m/d/Y-H:i:s.u", $fields[0]); // Check the 'CATEGORY' field for the text "(null)" and // substitute "Not Assigned". if ($fields[6] == "(null)") $fields[6] = "Not Assigned"; /* Time */ $alert_time = date_format($event_tm, "H:i:s"); /* Date */ $alert_date = date_format($event_tm, "m/d/Y"); /* Description */ $alert_descr = $fields[5]; $alert_descr_url = urlencode($fields[5]); /* Priority */ $alert_priority = $fields[7]; /* Protocol */ $alert_proto = $fields[8]; /* IP SRC */ $alert_ip_src = inet_ntop(inet_pton($fields[9])); /* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */ $alert_ip_src = str_replace(":", ":​", $alert_ip_src); /* Add Reverse DNS lookup icons */ $alert_ip_src .= "
"; $alert_ip_src .= " "; $alert_ip_src .= ""; $alert_ip_src .= ""; /* Add icons for auto-adding to Suppress List if appropriate */ if (!suricata_is_alert_globally_suppressed($supplist, $fields[2], $fields[3]) && !isset($supplist[$fields[2]][$fields[3]]['by_src'][$fields[9]])) { $alert_ip_src .= "  "; } elseif (isset($supplist[$fields[2]][$fields[3]]['by_src'][$fields[9]])) { $alert_ip_src .= "  "; } /* Add icon for auto-removing from Blocked Table if required */ // if (isset($tmpblocked[$fields[9]])) { // $alert_ip_src .= " "; // } /* IP SRC Port */ $alert_src_p = $fields[10]; /* IP Destination */ $alert_ip_dst = inet_ntop(inet_pton($fields[11])); /* Add zero-width space as soft-break opportunity after each colon if we have an IPv6 address */ $alert_ip_dst = str_replace(":", ":​", $alert_ip_dst); /* Add Reverse DNS lookup icons */ $alert_ip_dst .= "
"; $alert_ip_dst .= " "; $alert_ip_dst .= ""; $alert_ip_dst .= ""; /* Add icons for auto-adding to Suppress List if appropriate */ if (!suricata_is_alert_globally_suppressed($supplist, $fields[2], $fields[3]) && !isset($supplist[$fields[2]][$fields[3]]['by_dst'][$fields[11]])) { $alert_ip_dst .= "  "; } elseif (isset($supplist[$fields[2]][$fields[3]]['by_dst'][$fields[11]])) { $alert_ip_dst .= "  "; } /* Add icon for auto-removing from Blocked Table if required */ // if (isset($tmpblocked[$fields[11]])) { // $alert_ip_src .= " "; // } /* IP DST Port */ $alert_dst_p = $fields[12]; /* SID */ $alert_sid_str = "{$fields[2]}:{$fields[3]}"; if (!suricata_is_alert_globally_suppressed($supplist, $fields[2], $fields[3])) { $sidsupplink = ""; } else { $sidsupplink = ""; } /* Add icon for toggling rule state */ if (isset($disablesid[$fields[2]][$fields[3]])) { $sid_dsbl_link = ""; } else { $sid_dsbl_link = ""; } /* DESCRIPTION */ $alert_class = $fields[6]; echo "\n"; $counter++; } fclose($fd); @unlink("/tmp/alerts_suricata{$suricata_uuid}"); } } ?>
{$alert_date}
{$alert_time}
{$alert_priority} {$alert_proto} {$alert_class} {$alert_ip_src} {$alert_src_p} {$alert_ip_dst} {$alert_dst_p} {$alert_sid_str}
{$sidsupplink}  {$sid_dsbl_link}
{$alert_descr}