$val){ $offset = 0; $found = false; foreach ($temp_array as $tmp_key => $tmp_val) { if (!$found and strtolower($val[$subkey]) > strtolower($tmp_val[$subkey])) { $temp_array = array_merge((array)array_slice($temp_array,0,$offset), array($key => $val), array_slice($temp_array,$offset)); $found = true; }; $offset++; }; if (!$found) $temp_array = array_merge($temp_array, array($key => $val)); }; if ($sort_ascending) { $array = array_reverse($temp_array); } else $array = $temp_array; /* below is the complement for empty array test */ return true; }; /* check if suricata widget variable is set */ $suri_nentries = $config['widgets']['widget_suricata_display_lines']; if (!isset($suri_nentries) || $suri_nentries < 0) $suri_nentries = 5; // Called by Ajax to update alerts table contents if (isset($_GET['getNewAlerts'])) { $response = ""; $suri_alerts = suricata_widget_get_alerts(); $counter = 0; foreach ($suri_alerts as $a) { $response .= $a['instanceid'] . " " . $a['dateonly'] . "||" . $a['timeonly'] . "||" . $a['src'] . ":" . $a['srcport'] . "||"; $response .= $a['dst'] . ":" . $a['dstport'] . "||" . $a['priority'] . "||" . $a['category'] . "\n"; $counter++; if($counter >= $suri_nentries) break; } echo $response; return; } if(isset($_POST['widget_suricata_display_lines'])) { $config['widgets']['widget_suricata_display_lines'] = $_POST['widget_suricata_display_lines']; write_config("Saved Suricata Alerts Widget Displayed Lines Parameter via Dashboard"); header("Location: ../../index.php"); } // Read "$suri_nentries" worth of alerts from the top of the alerts.log file function suricata_widget_get_alerts() { global $config, $a_instance, $suri_nentries; $suricata_alerts = array(); /* read log file(s) */ $counter=0; foreach ($a_instance as $instanceid => $instance) { $suricata_uuid = $a_instance[$instanceid]['uuid']; $if_real = get_real_interface($a_instance[$instanceid]['interface']); // make sure alert file exists, then grab the most recent {$suri_nentries} from it // and write them to a temp file. if (file_exists("/var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log")) { exec("tail -{$suri_nentries} -r /var/log/suricata/suricata_{$if_real}{$suricata_uuid}/alerts.log > /tmp/surialerts_{$suricata_uuid}"); if (file_exists("/tmp/surialerts_{$suricata_uuid}")) { /* 0 1 2 3 4 5 6 7 8 9 10 11 12 */ /* File format: timestamp,action,sig_generator,sig_id,sig_rev,msg,classification,priority,proto,src,srcport,dst,dstport */ $fd = fopen("/tmp/surialerts_{$suricata_uuid}", "r"); while (($fields = fgetcsv($fd, 1000, ',', '"')) !== FALSE) { if(count($fields) < 13) continue; // Create a DateTime object from the event timestamp that // we can use to easily manipulate output formats. $event_tm = date_create_from_format("m/d/Y-H:i:s.u", $fields[0]); // Check the 'CATEGORY' field for the text "(null)" and // substitute "No classtype defined". if ($fields[6] == "(null)") $fields[6] = "No classtype assigned"; $suricata_alerts[$counter]['instanceid'] = strtoupper($a_instance[$instanceid]['interface']); $suricata_alerts[$counter]['timestamp'] = strval(date_timestamp_get($event_tm)); $suricata_alerts[$counter]['timeonly'] = date_format($event_tm, "H:i:s"); $suricata_alerts[$counter]['dateonly'] = date_format($event_tm, "M d"); // Add zero-width space as soft-break opportunity after each colon in any IPv6 address $suricata_alerts[$counter]['src'] = str_replace(":", ":​", $fields[9]); $suricata_alerts[$counter]['srcport'] = $fields[10]; // Add zero-width space as soft-break opportunity after each colon in any IPv6 address $suricata_alerts[$counter]['dst'] = str_replace(":", ":​", $fields[11]); $suricata_alerts[$counter]['dstport'] = $fields[12]; $suricata_alerts[$counter]['priority'] = $fields[7]; $suricata_alerts[$counter]['category'] = $fields[6]; $counter++; }; fclose($fd); @unlink("/tmp/surialerts_{$suricata_uuid}"); }; }; }; // Sort the alerts array if (isset($config['syslog']['reverse'])) { sksort($suricata_alerts, 'timestamp', false); } else { sksort($suricata_alerts, 'timestamp', true); } return $suricata_alerts; } /* display the result */ ?> "); $counter++; if($counter >= $suri_nentries) break; } } ?>
IF/Date Src/Dst Details
" . $alert['instanceid'] . " " . $alert['dateonly'] . "
" . $alert['timeonly'] . "
" . $alert['src'] . ":" . $alert['srcport'] . "
" . $alert['dst'] . ":" . $alert['dstport'] . "
Pri: " . $alert['priority'] . " " . $alert['category'] . "