diff options
author | Eddie Arrage <eddie.arrage@huawei.com> | 2018-03-20 23:51:35 +0000 |
---|---|---|
committer | Eddie Arrage <eddie.arrage@huawei.com> | 2018-03-31 00:11:00 +0000 |
commit | 56f50acd66d6f041b0347babb131150db3ca2023 (patch) | |
tree | 4a631df908d55fa7cd2fbf59c5854d06d811bf64 /samples/services/snort_ids/docker/grpc/snort_alerts.py | |
parent | c43c773fc33167f46461b4fd1ae58e40d390d59e (diff) |
Develop snort IDS and content inspect service
- Initial commit to show potential structure of a sample service
- This wil be part of a larger sample application currently dubbed
Service Delivery Controller
- Docker container needs to be built and employs open-source Linux packages
- Service is deployable in Istio service mesh using provided yaml
- Control snort daemon and add custom rules with GRPC messaging
- Process snort alerts actively and send to redis and upstream service
mesh components
- Integrates a web server for better HTTP signature detection
- Improved build script for CI with variables
- Render k8s yaml snort manifest dynamically with command
line options
- Improve snort_client sample script for runtime modifications
including passing args on CLI, error checking
- Update nginx proxy interface
- Added logging to snort server and alert process
Change-Id: Ic56f9fcd9ed21f64b84b85ac8ee280d69af7b7c9
Signed-off-by: Eddie Arrage <eddie.arrage@huawei.com>
Diffstat (limited to 'samples/services/snort_ids/docker/grpc/snort_alerts.py')
-rw-r--r-- | samples/services/snort_ids/docker/grpc/snort_alerts.py | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/samples/services/snort_ids/docker/grpc/snort_alerts.py b/samples/services/snort_ids/docker/grpc/snort_alerts.py new file mode 100644 index 0000000..eda2bd6 --- /dev/null +++ b/samples/services/snort_ids/docker/grpc/snort_alerts.py @@ -0,0 +1,57 @@ +# Copyright (c) Authors of Clover +# +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Apache License, Version 2.0 +# which accompanies this distribution, and is available at +# http://www.apache.org/licenses/LICENSE-2.0 + +import redis +import logging +import grpc +import nginx_pb2 +import nginx_pb2_grpc +from idstools import unified2 + + +HOST_IP = 'redis' +PROXY_GRPC = 'http-proxy:50054' + +logging.basicConfig(filename='alert.log', level=logging.DEBUG) + +connect = False +while not connect: + try: + r = redis.StrictRedis(host=HOST_IP, port=6379, db=0) + r.delete('snort_events') + connect = True + except Exception as e: + logging.debug(e) + connect = False + +reader = unified2.SpoolRecordReader("/var/log/snort", + "", follow=True) + + +def sendGrpcAlert(event_id, redis_key): + try: + channel = grpc.insecure_channel(PROXY_GRPC) + stub = nginx_pb2_grpc.ControllerStub(channel) + stub.ProcessAlerts(nginx_pb2.AlertMessage( + event_id=event_id, redis_key=redis_key)) + except Exception as e: + logging.debug(e) + + +for record in reader: + try: + if isinstance(record, unified2.Event): + snort_event = "snort_event:" + str(record['event-id']) + r.sadd('snort_events', str(record['event-id'])) + r.hmset(snort_event, record) + sendGrpcAlert(str(record['event-id']), 'snort_events') + # elif isinstance(record, unified2.Packet): + # print("Packet:") + # elif isinstance(record, unified2.ExtraData): + # print("Extra-Data:") + except Exception as e: + logging.debug(e) |