MISP
/
misp-dashboard
mirror of https://github.com/MISP/misp-dashboard
2
0
Fork 0
Code Issues Releases Wiki Activity

Probably fixed zmq bug in categ

pull/18/head
Sami Mokaddem 2017-10-25 16:21:35 +02:00
parent 3ffb999108
commit d1ad7543c9
1 changed files with 22 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
zmq_subscriber.py
View File

@ -21,7 +21,7 @@ CHANNELDISP = cfg.get('RedisMap', 'channelDisp')
CHANNEL_PROC = cfg.get('RedisMap', 'channelProc') CHANNEL_PROC = cfg.get('RedisMap', 'channelProc')
PATH_TO_DB = cfg.get('RedisMap', 'pathMaxMindDB') PATH_TO_DB = cfg.get('RedisMap', 'pathMaxMindDB')
redis_server = redis.StrictRedis( serv_log = redis.StrictRedis(
host=cfg.get('RedisLog', 'host'), host=cfg.get('RedisLog', 'host'),
port=cfg.getint('RedisLog', 'port'), port=cfg.getint('RedisLog', 'port'),
db=cfg.getint('RedisLog', 'db')) db=cfg.getint('RedisLog', 'db'))
@ -29,13 +29,23 @@ serv_coord = redis.StrictRedis(
host=cfg.get('RedisMap', 'host'), host=cfg.get('RedisMap', 'host'),
port=cfg.getint('RedisMap', 'port'), port=cfg.getint('RedisMap', 'port'),
db=cfg.getint('RedisMap', 'db')) db=cfg.getint('RedisMap', 'db'))
serv_redis_db = redis.StrictRedis(
host=cfg.get('RedisDB', 'host'),
port=cfg.getint('RedisDB', 'port'),
db=cfg.getint('RedisDB', 'db'))
reader = geoip2.database.Reader(PATH_TO_DB) reader = geoip2.database.Reader(PATH_TO_DB)
def publish_log(zmq_name, name, content): def publish_log(zmq_name, name, content):
to_send = { 'name': name, 'log': json.dumps(content), 'zmqName': zmq_name } to_send = { 'name': name, 'log': json.dumps(content), 'zmqName': zmq_name }
redis_server.publish(CHANNEL, json.dumps(to_send)) serv_log.publish(CHANNEL, json.dumps(to_send))
def push_to_redis_zset(keyCateg, toAdd):
now = datetime.datetime.now()
today_str = str(now.year)+str(now.month)+str(now.day)
keyname = "{}:{}".format(keyCateg, today_str)
serv_redis_db.zincrby(keyname, toAdd)
def ip_to_coord(ip): def ip_to_coord(ip):
@ -54,10 +64,8 @@ def getCoordAndPublish(zmq_name, supposed_ip, categ):
coord = rep['coord'] coord = rep['coord']
coord_dic = {'lat': coord['lat'], 'lon': coord['lon']} coord_dic = {'lat': coord['lat'], 'lon': coord['lon']}
coord_list = [coord['lat'], coord['lon']] coord_list = [coord['lat'], coord['lon']]
now = datetime.datetime.now() push_to_redis_zset('GEO_COORD', json.dumps(coord_dic))
today_str = str(now.year)+str(now.month)+str(now.day) push_to_redis_zset('GEO_COUNTRY', rep['full_rep'].country.iso_code)
keyname = 'GEO_' + today_str
serv_coord.zincrby(keyname, coord_list)
to_send = { to_send = {
"coord": coord, "coord": coord,
"categ": categ, "categ": categ,
@ -85,38 +93,36 @@ def handler_keepalive(zmq_name, jsonevent):
publish_log(zmq_name, 'Keepalive', to_push) publish_log(zmq_name, 'Keepalive', to_push)
def handler_event(zmq_name, jsonevent): def handler_event(zmq_name, jsonevent):
#print(jsonevent)
#fields: threat_level_id, id, info #fields: threat_level_id, id, info
jsonevent = jsonevent['Event'] jsonevent = jsonevent['Event']
#redirect to handler_attribute #redirect to handler_attribute
if 'Attribute' in jsonevent: if 'Attribute' in jsonevent:
attributes = jsonevent['Attribute'] attributes = jsonevent['Attribute']
print("+--------- EVENTS -----------+") if type(attributes) is list:
print(attributes)
if attributes is list:
for attr in attributes: for attr in attributes:
handler_attribute(zmq_name, attr) handler_attribute(zmq_name, attr)
else: else:
handler_attribute(zmq_name, jsonevent) handler_attribute(zmq_name, attributes)
def handler_attribute(zmq_name, jsonattr): def handler_attribute(zmq_name, jsonattr):
print("+--------- ATTRIBUTE -----------+") # check if jsonattr is an attribute object
jsonattr = jsonattr['Attribute'] if 'Attribute' in jsonattr:
print(jsonattr) jsonattr = jsonattr['Attribute']
to_push = [] to_push = []
for field in json.loads(cfg.get('Log', 'fieldname_order')): for field in json.loads(cfg.get('Log', 'fieldname_order')):
print(field)
if type(field) is list: if type(field) is list:
to_add = cfg.get('Log', 'char_separator').join([ jsonattr[subField] for subField in field ]) to_add = cfg.get('Log', 'char_separator').join([ jsonattr[subField] for subField in field ])
else: else:
to_add = jsonattr[field] to_add = jsonattr[field]
to_push.append(to_add) to_push.append(to_add)
#try to get coord #try to get coord from ip
if jsonattr['category'] == "Network activity": if jsonattr['category'] == "Network activity":
getCoordAndPublish(zmq_name, jsonattr['value'], jsonattr['category']) getCoordAndPublish(zmq_name, jsonattr['value'], jsonattr['category'])
# Push to log
publish_log(zmq_name, 'Attribute', to_push) publish_log(zmq_name, 'Attribute', to_push)