Snort mailing list archives
Re: Snort/mysql/acid and dshield.org
From: "Dusty Hall" <halljer () auburn edu>
Date: Mon, 01 Mar 2004 08:42:51 -0600
Jonathan, Try this... let me know your thoughts/questions. -Dusty ================================== #!/usr/bin/perl #---------------------------------------- # name: dshield.pl # # description: script to send snort alert information from a mysql db to dshield.org # # comments: dusty hall, halljer@<NOSPAM>auburn.edu #---------------------------------------- use strict; use DBI; use Mail::Sender; my $to = "reports\@dshield.org"; #my $to = ""; my $from = ""; my $smtp = "", my $dshield_id = ""; my $tz = "-06:00"; my $db_name = ""; my $ds = "dbi:mysql:$db_name"; my $db_user = ""; my $db_pass = ""; my $db = DBI->connect($ds, $db_user, $db_pass) or die $DBI::errstr; my ($time_select,$exec_time_select,$start_time); my ($sid,$cid,$timestamp,$src_ip,$src_port,$dst_ip,$dst_port,$proto,$random); $start_time = `date --date='2 hours ago' +'%Y-%m-%d %H:00'`; chomp $start_time; # without rand() function, you'll need to change the bind statement too! #$time_select = "select acid_event.sid, acid_event.cid, timestamp, inet_ntoa(acid_event.ip_src), acid_event.layer4_sport, inet_ntoa(acid_event.ip_dst), acid_event.layer4_dport, acid_event.ip_proto FROM acid_event WHERE timestamp > '$start_time' order by timestamp"; # with rand() function $time_select = "select acid_event.sid, acid_event.cid, timestamp, inet_ntoa(acid_event.ip_src), acid_event.layer4_sport, inet_ntoa(acid_event.ip_dst), acid_event.layer4_dport, acid_event.ip_proto, rand(acid_event.cid) as random FROM acid_event WHERE timestamp > '$start_time' order by random limit 1000"; $exec_time_select = $db->prepare($time_select); $exec_time_select->execute(); #$exec_time_select->bind_columns(undef,\$sid,\$cid,\$timestamp,\$src_ip,\$src_port,\$dst_ip,\$dst_port,\$proto); $exec_time_select->bind_columns(undef,\$sid,\$cid,\$timestamp,\$src_ip,\$src_port,\$dst_ip,\$dst_port,\$proto,\$random); my $sender = new Mail::Sender{ smtp => "$smtp", from => "$from"}; $sender->OpenMultipart({to => "$to", cc => "$from", subject => "FORMAT DSHIELD USERID $dshield_id TZ $tz" }); while ($exec_time_select->fetch) { $sender->SendEnc("\n$timestamp $tz\t$dshield_id\t1\t$src_ip\t$src_port\t$dst_ip\t$dst_port\t$proto"); } print $Mail::Sender::Error; $sender->Close(); $exec_time_select->finish; =======================================
"Miner, Jonathan W" <jonathan.w.miner () baesystems com> 3/1/2004
8:18:01 AM >>> Hello - I've gotten snort/mysql/acid working fine on Solaris 9. Thanks to the docs on the Snort.org website! My question... is there anyone that has written the sql code needed to pull the data out of the database and send it to dshield.org? Thanks ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------- SF.Net is sponsored by: Speed Start Your Linux Apps Now. Build and deploy apps & Web services for Linux with a free DVD software kit from IBM. Click Now! http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Snort/mysql/acid and dshield.org Miner, Jonathan W (Mar 01)
- <Possible follow-ups>
- Re: Snort/mysql/acid and dshield.org Dusty Hall (Mar 01)