Beispiel #1
0
def getPreviousElementsBoundary(sourceID, previousClass, previousType,
                                direction, boundary, con):
    #if(previousType==None):
    #aql = "FOR v IN 1..2 INBOUND '{0}' elementAssoc FILTER v.class == '{1}' && v.type==null RETURN DISTINCT v".format(
    #sourceID,  previousClass, previousType)
    if (tools.isEqual(direction, 'in') and previousType != None):
        aql = "FOR v IN 1..{0} INBOUND 'element/{1}' elementAssoc FILTER v.class == '{2}' && v.type=='{3}' RETURN DISTINCT v".format(
            boundary, sourceID, previousClass, previousType)
    if (tools.isEqual(direction, 'out') and previousType != None):
        aql = "FOR v IN 1..{0} OUTBOUND 'element/{1}' elementAssoc FILTER v.class == '{2}' && v.type=='{3}' RETURN DISTINCT v".format(
            boundary, sourceID, previousClass, previousType)
    query = con.AQLQuery(aql, rawResults=True)
    return query
def readFile(hostFile, portnames):
    #open switch list file for reading
    p0f = open(hostFile, "r")
    output = dict()
    #read each host and perform actions, sequentially
    lines = p0f.readlines()
    synAckSet = set()
    for i in range(0, len(lines)):
        osInfo = None
        line = re.findall(r'\|([\w\d\.\=\/?:\+\s]+)', lines[i])
        if (line != None):
            mod = re.search(r'mod=([\w\+]*)', lines[i]).group(1).strip()
            date = re.search(r'^\[(\d+\/\d+\/\d+)', lines[i]).group(1).strip()
            cli = line[0].strip('cli=').split('/')[0]
            #cliport=line[0].strip('cli=').split('/')[1]
            srv = line[1].strip('srv=').split('/')[0]
            srvport = line[1].strip('cli=').split('/')[1]
            #if(int(srvport)>10000):srvport='0'
            subj = line[2].partition('=')[2]
            portN = ''
            if ((srvport, 'tcp') in portnames):
                portN = portnames.get((srvport, 'tcp'))
            if (tools.isEqual(mod, 'syn') or tools.isEqual(mod, 'syn+ack')):
                os = line[3].partition('=')[2]
                if ('and' in os):
                    os = os.split('and')[0]
                elif ('or' in os):
                    os = os.split('or')[0]
                if ('Microsoft' in os or 'Windows' in os):
                    platform = 'Windows'
                    duplicatesL = paperRUN.winDuplicatesL
                    versionL = paperRUN.winVersionL
                else:
                    platform = 'Linux'
                    duplicatesL = paperRUN.linDuplicatesL
                    versionL = []
                if (os != None and os != '' and os != '???'):
                    osInfo = paperRUN.getStandardOpsysName(
                        os, platform, duplicatesL, versionL, paperRUN.coll,
                        paperRUN.collAssoc, paperRUN.con)
                    dist = line[4].partition('=')[2]
                    param = line[5].partition('=')[2]

                    if ('NMap' not in os and 'scan' not in os
                            and int(srvport) < 49152):
                        synAckSet.add(
                            (cli, srv, subj, ' '.join(osInfo), dist, srvport))
    output['p0f'] = synAckSet
    p0f.close()
    return output
Beispiel #3
0
def store(sourceName, scope, mainip ,data, hash, date, client):
	checkStart = client['metaelement'].fetchByExample({'type': "startpoint", "label": "start"}, batchSize=100)
	if (len(checkStart) == 0):
		startKey = storeMetaelementArango('metaelement', 'startpoint', 'start', client)
	else:
		startKey = checkStart[0]._id
	checkTP = client['metaelement'].fetchByExample({'type': "timepoint","label": date}, batchSize = 100)
	if (len(checkTP) == 0):
		tpKey=storeMetaelementArango('metaelement','timepoint',date, client )
		storeAssocArango('metaelementAssoc', startKey, tpKey, 'startTimepoint', client)
	else:
		tpKey= checkTP[0]._id
	srcId = storeMetaelementArango('metaelement', 'source', str(sourceName)+'_'+str(mainip), client)
	srcK = srcId.split('/')[1]
	tempsrc = client['metaelement'].fetchDocument(srcK)
	tempsrc['hash'] = hash
	tempsrc['scope'] = scope
	tempsrc.patch()
	storeAssocArango('metaelementAssoc', tpKey, srcId, 'timepointSource', client)
	pf=data.get('pfSense')
	domain=pf.get('domain')
	filterL=pf.get('filterList')
	hostName=pf.get('hostName')
	interfaces=pf.get('ifList')
	users=pf.get('userList')
	vlans=pf.get('vlanList')
	#nodeKey = storeElementArango('element', 'node', 'embedded', str(mainip)+';;'+str(hostName), None, client)
	nodeKey = storeElementArango('element', 'node', 'embedded', str(mainip), None, client)
	aclKey = storeElementArango('element', 'accessControl', 'local', domain, None, client)
	storeAssocArango('elementAssoc', nodeKey, aclKey, 'zoneNode', client)
	for inf in interfaces:
			zone=None
			ifAddress=inf.get('ifAddress')
			ifDescr=inf.get('ifDescription')
			ifName=inf.get('ifName')
			ifSubn=inf.get('ifSubnet')
			if(tools.isEqual(ifSubn,'24')):
				zone=tools.create24Zone(ifAddress)
				netwKey = storeElementArango('element', 'interface', 'network', ifAddress, None, client)
				netwzoneKey = storeElementArango('element', 'zone', 'network', zone, None, client)
				storeAssocArango('elementAssoc', netwzoneKey, netwKey, 'zoneNode', client)
				storeAssocArango('elementAssoc', netwKey, nodeKey, 'zoneNode', client)
				storeAssocArango('metaelementAssoc', srcId, netwzoneKey, 'sourceNetwork', client)
				ifNameKey = storeElementArango('element', 'property', 'interfaceName', ifName, None, client)
				ifDescKey = storeElementArango('element', 'property', 'interfaceDescription', ifDescr, None, client)
				storeAssocArango('elementAssoc', netwKey, ifNameKey, 'property', client)
				storeAssocArango('elementAssoc', netwKey, ifDescKey, 'property', client)
	for us in users:
		groupName=us.get('groupName')
		userName=us.get('userName')
		uid=us.get('uid')
		userKey = storeElementArango('element', 'userAccount', 'local', userName, None, client)
		storeAssocArango('elementAssoc', aclKey, userKey, 'aclUA', client)
		uidKey = storeElementArango('element', 'property', 'uid', uid, None, client)
		storeAssocArango('elementAssoc', userKey, uidKey, 'property', client)
		groupKey = storeElementArango('element', 'property', 'userGroup', groupName, None, client)
		storeAssocArango('elementAssoc', userKey, groupKey, 'property', client)
Beispiel #4
0
def getFrequency(output):
    for o in output:
        oCounter = set()
        oConValue = o.get('connectedValue')
        oConEntity = o.get('connected')
        if (oConEntity == None and oConValue == None):
            oConId = o.get('connectedID')
            for r in output:
                oId = r.get('id')
                oValue = r.get('value')
                oEntity = r.get('entity')
                if (tools.isEqual(oConId, oId)
                        and (oEntity != None and oValue != None)):
                    oCounter.add((oId, oEntity, oValue))
                    print('success')
            print(collections.Counter(oCounter))
            print(oCounter)
Beispiel #5
0
def readFile(hostFile):
    ns = {'xmlns': "http://schemas.microsoft.com/powershell/2004/04"}
    #open switch list file for reading
    tree = ET.parse(hostFile)
    root = tree.getroot()
    output = dict()
    compName = None
    caption = None  #Caption
    disabled = None  #Disabled
    domain = None  #Domain
    local = None  #LocalAccount
    lockout = None  #Lockout
    acName = None  #Name
    passwordReq = None  #PasswordRequired
    passwordExp = None  #PasswordExpires
    sid = None  #SID
    for i in root.findall("xmlns:Obj", ns):
        props = i.find("xmlns:Props", ns)
        ms = i.find("xmlns:MS/xmlns:S", ns)
        compName = ms.text
        for s in props:
            if ('Nil' not in s.tag):
                if (tools.isEqual(s.attrib.get('N'), "Name")):
                    name = s.text
                if (tools.isEqual(s.attrib.get('N'), "LocalAccount")):
                    local = s.text
                if (tools.isEqual(s.attrib.get('N'), "Domain")):
                    domain = s.text
                if (tools.isEqual(s.attrib.get('N'), "PasswordRequired")):
                    passwordReq = s.text
                if (tools.isEqual(s.attrib.get('N'), "SID")):
                    sid = s.text
                if (tools.isEqual(s.attrib.get('N'), "PasswordExpires")):
                    passwordExp = s.text
        if (sid != None):
            output[sid] = {
                "name": name,
                "localAccount": local,
                "domain": domain,
                "compName": compName,
                'passwordRequired': passwordReq,
                'passwordExpires': passwordExp
            }
    return (output)
Beispiel #6
0
def hosts(dataFile):
    tree = ET.parse(dataFile)
    root = tree.getroot()
    hostsDict = dict()

    #id_counter = count()
    for i in root.findall("nodes/node"):
        tempCVEL = []
        services = dict()
        opsys = dict()
        nodeName = i.find("names/name")
        if (nodeName is not None): nodeName = nodeName.text
        address = i.get("address")
        riskScore = i.get("risk-score")
        id_counter = count()
        for e in i.findall("endpoints/endpoint"):
            serviceProtocol = e.get("protocol").strip("?")
            servicePort = e.get("port")
            sn = e.find("services/service")
            serviceName = sn.get("name").strip("?")
            services[servicePort] = {
                # 'servicePort': servicePort,
                'protocol': serviceProtocol,
                "serviceName": serviceName
            }
        collected = set()
        for o in i.findall("tests/test"):
            id = o.get("id")
            cveR = []
            cve = None
            cveR = re.findall(r'cve-[0-9]{4}-[0-9]*', id)
            if (len(cveR) == 1):
                cve = cveR[0]
            if (cve != None):
                tempCVEL.append(cve)
        for o in i.findall("fingerprints/os"):
            osVendor = o.get("vendor")
            osFamily = o.get("family")
            osProduct = o.get("product")
            osVersion = o.get("version")
            osArch = o.get("arch")
            osCertainty = o.get("certainty")
            if (osVersion == None):
                standardName = str(osVendor) + ' ' + str(osProduct)
            elif (osVersion != None):
                if (tools.isEqual(osVendor, osProduct)):
                    standardName = str(osProduct) + ' ' + str(osVersion)
                else:
                    standardName = str(osVendor) + ' ' + str(
                        osProduct) + ' ' + str(osVersion)
            #print(standardName)
            # Add host
            if (standardName not in collected):
                if ('Microsoft' in standardName or 'Windows' in standardName):
                    platform = 'Windows'
                    duplicatesL = paperRUN.winDuplicatesL
                    versionL = paperRUN.winVersionL
                else:
                    platform = 'Linux'
                    duplicatesL = paperRUN.linDuplicatesL
                    versionL = []
                osInfo = paperRUN.getStandardOpsysName(standardName, platform,
                                                       duplicatesL, versionL,
                                                       paperRUN.coll,
                                                       paperRUN.collAssoc,
                                                       paperRUN.con)
                opsys[generate_id(id_counter)] = {
                    'standardName': osInfo[0],
                    "osVendor": osVendor,
                    "osFamily": osFamily,
                    "osProduct": osProduct,
                    "osVersion": osInfo[1],
                    "osArch": osArch,
                    "osCertainty": osCertainty
                }
                collected.add(standardName)
        hostsDict[address] = {
            'name': nodeName,
            "opsys": opsys,
            "services": services,
            'cve': tempCVEL
        }
    return hostsDict
Beispiel #7
0
def store(dataSource,scope, data, hash, date, client):
        checkStart = client['metaelement'].fetchByExample({'type': "startpoint","label": "start"}, batchSize = 100)
        if (len(checkStart) == 0):
            startKey=storeMetaelementArango('metaelement','startpoint','start', client )
        else: startKey= checkStart[0]._id

        checkTP = client['metaelement'].fetchByExample({'type': "timepoint","label": date}, batchSize = 100)
        if (len(checkTP) == 0):
            tpKey=storeMetaelementArango('metaelement','timepoint',date, client )
            storeAssocArango('metaelementAssoc', startKey, tpKey, 'startTimepoint', client)
        else: tpKey= checkTP[0]._id
        srcId=storeMetaelementArango('metaelement', 'source', dataSource, client)
        srcK=srcId.split('/')[1]
        tempsrc=client['metaelement'].fetchDocument(srcK)
        tempsrc['hash'] = hash
        tempsrc['scope'] = scope
        tempsrc.patch()
        storeAssocArango('metaelementAssoc', tpKey, srcId, 'timepointSource', client)
         #Source to Network
        zoneDict=dict()
        for key, val in data.items():
            address = key
            zone= address.split('.')
            zone[3]=('0')
            zone='.'.join(zone)
            if(zone not in zoneDict):
                netwKey=storeElementArango('element', 'zone', 'network', zone, None, client)
                zoneDict[zone]=netwKey
                storeAssocArango('metaelementAssoc', srcId, netwKey, 'sourceNetwork',client )

        #Network zone to Opsys
        for key, val in data.items():
            address = key
            zone= address.split('.')
            zone[3]=('0')
            zone='.'.join(zone)
            services = val.get("services")
            netwKey=zoneDict.get(zone)
            opsys = val.get("opsys")

            interfaceKey = storeElementArango('element', 'interface', 'network', address, None, client)
            nodeKey = storeElementArango('element', 'node', 'general', str(address), None, client)
            storeAssocArango('elementAssoc', netwKey, interfaceKey, 'networkInterface', client)
            storeAssocArango('elementAssoc', interfaceKey, nodeKey, 'interfaceNode', client)
            for d in opsys.values():
                osCertainty = d.get("osCertainty")
                osName=d.get("osName").strip()
                spKey=storeElementArango('element', 'softwareInstance','operatingSystem', osName, osCertainty , client)
                storeAssocArango('elementAssoc', nodeKey, spKey, 'nodeSoftware', client)

        #Operating system to Software Product
            for k,v in services.items():
                port = k
                protocol = v.get("protocol")
                serviceName = v.get("serviceName")
                serviceState=v.get('serviceState')
                if(tools.isEqual(serviceState,'open') or tools.isEqual(serviceState,'open|filtered')): #Add only open service ports
                    if(serviceName=="unknown"):
                        serviceName = ('-'.join((port, protocol)))
                    else:
                        serviceName = ('-'.join((port, protocol, serviceName)))
                    serverName = v.get("serviceSoftware")
                    servKey=storeElementArango('element','softwareInstance','server',serviceName, None, client)
                    storeAssocArango('elementAssoc', nodeKey, servKey,'nodeServer',client)
                    if(protocol!=None):
                        protKey = storeElementArango('element', 'property','protocol', protocol, None, client)
                        storeAssocArango('elementAssoc', servKey, protKey, 'property', client)

                    if(serverName!=None):
                        srvSpKey = storeElementArango('element', 'property','serverName', serverName, None, client)
                        storeAssocArango('elementAssoc', servKey, srvSpKey, 'serverSoftwareproduct', client)
Beispiel #8
0
def store(sourceName, scope, mainIP, nodeName, data, hash, date, client):
    checkStart = client['metaelement'].fetchByExample(
        {
            'type': "startpoint",
            "label": "start"
        }, batchSize=100)
    if (len(checkStart) == 0):
        startKey = storeMetaelementArango('metaelement', 'startpoint', 'start',
                                          client)
    else:
        startKey = checkStart[0]._id
    checkTP = client['metaelement'].fetchByExample(
        {
            'type': "timepoint",
            "label": date
        }, batchSize=100)
    if (len(checkTP) == 0):
        tpKey = storeMetaelementArango('metaelement', 'timepoint', date,
                                       client)
        storeAssocArango('metaelementAssoc', startKey, tpKey, 'startTimepoint',
                         client)
    else:
        tpKey = checkTP[0]._id
    srcId = storeMetaelementArango('metaelement', 'source',
                                   str(sourceName) + '_' + str(nodeName),
                                   client)
    srcK = srcId.split('/')[1]
    tempsrc = client['metaelement'].fetchDocument(srcK)
    tempsrc['hash'] = hash
    tempsrc['scope'] = scope
    tempsrc.patch()
    storeAssocArango('metaelementAssoc', tpKey, srcId, 'timepointSource',
                     client)
    #nodeKey = storeElementArango('element', 'node', 'general', str(mainIP)+';;'+str(nodeName), None, client)
    nodeKey = storeElementArango('element', 'node', 'general', str(mainIP),
                                 None, client)
    zone = tools.create24Zone(mainIP)
    netwzoneKey = storeElementArango('element', 'zone', 'network', zone, None,
                                     client)
    interfaceKey = storeElementArango('element', 'interface', 'network',
                                      mainIP, None, client)
    #aclKey = storeElementArango('element', 'accessControl', 'local', sourceName, None, client)
    storeAssocArango('metaelementAssoc', srcId, netwzoneKey, 'sourceZone',
                     client)
    storeAssocArango('elementAssoc', netwzoneKey, interfaceKey,
                     'zoneInterface', client)
    storeAssocArango('elementAssoc', interfaceKey, nodeKey, 'interfaceNode',
                     client)
    domainz = dict()

    for key, val in data.items():

        compName = val.get('compName')
        assert tools.isEqual(compName, nodeName)
        domain = val.get('domain')
        localA = val.get('localAccount')
        name = val.get('name')
        passwordExp = val.get('passwordExpires')
        passwordReq = val.get('passwordRequired')

        if (domain not in domainz and tools.isEqual(localA, 'true')):
            aclKey = storeElementArango('element', 'accessControl', 'local',
                                        domain, None, client)
            storeAssocArango('elementAssoc', nodeKey, aclKey, 'NodeAC', client)
            domainz[domain] = aclKey
        elif (domain not in domainz and tools.isEqual(localA, 'false')):
            aclKey = storeElementArango('element', 'accessControl', 'domain',
                                        domain, None, client)
            storeAssocArango('elementAssoc', nodeKey, aclKey, 'NodeAC', client)
            domainz[domain] = aclKey
        else:
            aclKey = domainz.get(domain)
        sidKey = storeElementArango('element', 'property', 'SID', key, None,
                                    client)
        if (tools.isEqual(passwordReq, 'true')):
            uacKey = storeElementArango('element', 'userAccount', 'password',
                                        name, None, client)
            oCKey = storeElementArango('element', 'property',
                                       'passwordExpires', passwordExp, None,
                                       client)
        elif (tools.isEqual(passwordReq, 'false')):
            uacKey = storeElementArango('element', 'userAccount', 'undefined',
                                        name, None, client)
            oCKey = storeElementArango('element', 'property',
                                       'passwordExpires', passwordExp, None,
                                       client)
        if (tools.isEqual(passwordReq, 'true')
                or tools.isEqual(passwordReq, 'false')):
            # Associations
            storeAssocArango('elementAssoc', aclKey, uacKey, 'property',
                             client)
            storeAssocArango('elementAssoc', uacKey, oCKey, 'property', client)
            storeAssocArango('elementAssoc', uacKey, sidKey, 'property',
                             client)
Beispiel #9
0
def store(sourceName, scope, nodeip, nodeName, data, hash, date, client):
    checkStart = client['metaelement'].fetchByExample(
        {
            'type': "startpoint",
            "label": "start"
        }, batchSize=100)
    if (len(checkStart) == 0):
        startKey = storeMetaelementArango('metaelement', 'startpoint', 'start',
                                          client)
    else:
        startKey = checkStart[0]._id
    checkTP = client['metaelement'].fetchByExample(
        {
            'type': "timepoint",
            "label": date
        }, batchSize=100)
    if (len(checkTP) == 0):
        tpKey = storeMetaelementArango('metaelement', 'timepoint', date,
                                       client)
        storeAssocArango('metaelementAssoc', startKey, tpKey, 'startTimepoint',
                         client)
    else:
        tpKey = checkTP[0]._id
    srcId = storeMetaelementArango('metaelement', 'source',
                                   str(sourceName) + '_' + str(nodeName),
                                   client)
    srcK = srcId.split('/')[1]
    tempsrc = client['metaelement'].fetchDocument(srcK)
    tempsrc['hash'] = hash
    tempsrc['scope'] = scope
    tempsrc.patch()
    storeAssocArango('metaelementAssoc', tpKey, srcId, 'timepointSource',
                     client)
    #nodeKey = storeElementArango('element', 'node', 'general', str(nodeip)+';;'+str(nodeName), None, client)
    nodeKey = storeElementArango('element', 'node', 'general', str(nodeip),
                                 None, client)
    zoned = dict()
    zonedSrc = set()
    zonedIf = set()
    nodeIf = set()
    nodeZone = tools.returnNetworkZone2args(nodeip)
    netwzoneKey = storeElementArango('element', 'zone', 'network', nodeZone,
                                     None, client)
    zoned[nodeZone] = netwzoneKey
    nodeInterfaceKey = storeElementArango('element', 'interface', 'network',
                                          nodeip, None, client)
    # Connecting source with zone with interface
    storeAssocArango('metaelementAssoc', srcId, netwzoneKey, 'sourceZone',
                     client)
    zonedSrc.add((srcId, netwzoneKey))
    storeAssocArango('elementAssoc', netwzoneKey, nodeInterfaceKey,
                     'zoneInterface', client)
    zonedIf.add((netwzoneKey, nodeInterfaceKey))

    for val in data.values():
        serviceName = val.get('name').strip()
        localIP = val.get('localIP').strip()
        localPort = val.get('localPort').strip()
        foreignIP = val.get('foreignIP').strip()
        foreignPort = val.get('foreignPort').strip()
        protocol = val.get('protocol').strip()
        state = val.get('state')
        locZone = None
        if (localIP != '0.0.0.0' and localIP != '127.0.0.1'):
            locZone = tools.returnNetworkZone2args(localIP)

        else:
            locZone = nodeZone
        if (foreignIP != '0.0.0.0' and foreignIP != '127.0.0.1'):
            forZone = tools.returnNetworkZone2args(foreignIP)
        if (locZone not in zoned):
            netwzoneKey = storeElementArango('element', 'zone', 'network',
                                             locZone, None, client)
            storeAssocArango('metaelementAssoc', srcId, netwzoneKey,
                             'sourceZone', client)
            zoned[locZone] = netwzoneKey
        else:
            netwzoneKey = zoned.get(locZone)
        #Creating the interfaces

        if (localIP != '0.0.0.0' and localIP != '127.0.0.1'):
            interfaceKey = getInterfaceByExample(nodeKey, localIP, 'element',
                                                 client)
            if (interfaceKey == None):
                interfaceKey = storeElementArango('element', 'interface',
                                                  'network', localIP, None,
                                                  client)
        else:
            interfaceKey = nodeInterfaceKey

        #Connecting source with zone with interface
        if ((netwzoneKey, interfaceKey) not in zonedIf):
            storeAssocArango('elementAssoc', netwzoneKey, interfaceKey,
                             'zoneInterface', client)
            zonedIf.add((netwzoneKey, interfaceKey))

        #Reasoning over foreign interface
        #foreignInterfaceKey=getForeignInterfaceByExample(nodeKey,foreignIP,'element',client)
        #if(foreignInterfaceKey==None):
        #foreignInterfaceKey = storeElementArango('element', 'interface', 'network', foreignIP, None, client)
        #foreignZone=tools.create24Zone(foreignIP)
        #if (foreignZone not in zoned):
        #fnetwzoneKey = storeElementArango('element', 'zone', 'network', zone, None, client)
        #zoned[foreignZone] = fnetwzoneKey
        #else:
        #fnetwzoneKey = zoned.get(zone)
        #if(fnetwzoneKey!=None):
        #storeAssocArango('metaelementAssoc', srcId, fnetwzoneKey,'sourceZone', client)
        #storeAssocArango('elementAssoc', fnetwzoneKey, foreignInterfaceKey, 'zoneInterface', client)

        if ((interfaceKey, nodeKey) not in nodeIf):
            storeAssocArango('elementAssoc', interfaceKey, nodeKey,
                             'interfaceNode', client)
            nodeIf.add((interfaceKey, nodeKey))

        if (tools.isEqual(state, 'LISTEN')):
            serviceNameKey = storeElementArango('element', 'softwareInstance',
                                                'server', serviceName, None,
                                                client)
            protocolKey = storeElementArango('element', 'property', 'protocol',
                                             protocol, None, client)
            # Properties for protocol
            protoDestPort = storeElementArango('element', 'property',
                                               'destinationPort', foreignPort,
                                               None, client)
            protoLocalPort = storeElementArango('element', 'property',
                                                'localPort', localPort, None,
                                                client)
            # Associations
            storeAssocArango('elementAssoc', protocolKey, protoDestPort,
                             'property', client)
            storeAssocArango('elementAssoc', protocolKey, protoLocalPort,
                             'property', client)
            storeAssocArango('elementAssoc', serviceNameKey, protocolKey,
                             'property', client)
            storeAssocArango('elementAssoc', nodeKey, serviceNameKey,
                             'nodeServer', client)

        if (tools.isEqual(state, 'ESTABLISHED')):
            flow = None
Beispiel #10
0
def generateSW(hosts, services, clients):
    swpoutput = []
    newPrevList = []
    for h in hosts:
        elementID = h.get('id')
        entity = h.get('entity')
        value = h.get('value')
        source = h.get('source')
        scope = h.get('sourceScope')
        properties = h.get('properties')
        for p in properties:
            swentity = p.get('type')
            if (tools.isEqual('operatingSystem', swentity)):
                swid = p.get('id')
                swlabel = p.get('label')
                swexistence = p.get('existence')
                swpoutput.append({
                    'source':
                    source,
                    'sourceScope':
                    scope,
                    'entity':
                    'SoftwareProduct',
                    'id':
                    swid,
                    'value':
                    swlabel,
                    'existence':
                    swexistence,
                    'associationsTo': [{
                        'targetClass': entity,
                        'targetID': elementID,
                        'targetLabel': value,
                        'type': 'Software status'
                    }],
                    'associationsFrom': []
                })
        #Value should come from the property name, ID is the object id
        #newPrevList.append({'type':entity, 'id':elementID, 'label':value})
        #swpoutput.append({'source': source, 'entity': 'softwareProduct', 'value': asLabel, 'connectedList':newPrevList})
    #for s in services:
    #elementID = s.get('id')
    #swpid=str(elementID)+'SWP'
    #entity = s.get('entity')
    #value = s.get('value')
    #source = s.get('source')
    #scope = h.get('sourceScope')
    #existence = s.get('existence')
    #swpoutput.append({'source': source, 'sourceScope': scope,'entity': 'SoftwareProduct','id':swpid, 'value': value, 'existence': None,
    #'associationsTo': [{'targetClass': entity, 'targetID': elementID, 'targetLabel': value,'existence': existence, 'type':'Software status'}],'associationsFrom':[]})
    #for c in clients:
    #elementID = c.get('id')
    #swpid = str(elementID) + 'SWP'
    #entity = c.get('entity')
    #value = c.get('value')
    #source = c.get('source')
    #scope = h.get('sourceScope')
    #existence = c.get('existence')
    #swpoutput.append({'source': source, 'sourceScope': scope,'entity': 'SoftwareProduct','id':swpid, 'value': value, 'existence': None,
    #                 'associationsTo': [{'targetClass': entity, 'targetID': elementID, 'targetLabel': value, 'existence': existence, 'type':'Software status'}],'associationsFrom':[]})

    return swpoutput
Beispiel #11
0
def modelData2DB(modelD, client):
    sourceDict = dict()
    netwAssoc = set()
    idKeyDict = dict()
    collection = 'collectedModel'
    collectionAssoc = 'collectedModelAssoc'
    checkStart = client[collection].fetchByExample(
        {
            'type': "modelData",
            "label": "securiCAD"
        }, batchSize=100)
    if (len(checkStart) == 0):
        startKey = storeMetaelementArango(collection, 'modelData', 'securiCAD',
                                          client)
    else:
        startKey = checkStart[0]._id
    for key, val in modelD.items():
        for v in val:
            dbid = v.get('id')
            entity = v.get('entity')
            src = v.get('source')
            srcScp = v.get('sourceScope')
            elval = v.get('value')
            elex = v.get('existence')
            if (src not in sourceDict):
                srcKey = storeModelSourceArango(collection, 'source', src,
                                                srcScp, None, client)
                storeAssocArango(collectionAssoc, startKey, srcKey, 'start',
                                 client)
                sourceDict[src] = srcKey
            else:
                srcKey = sourceDict.get(src)
            #print(str(entity)+' '+str(dbid)+' '+str(elval))
            modelElKey = storeModelDataKeyArango(collection, dbid, entity,
                                                 elval, elex, client)
            print('Storing class: ', entity, elval, dbid, ' from ', src)
            idKeyDict[dbid] = modelElKey
            if (tools.isEqual(entity, 'Network')
                    and (srcKey, modelElKey) not in netwAssoc):
                storeAssocArango(collectionAssoc, srcKey, modelElKey, 'fromTo',
                                 client)
                netwAssoc.add((srcKey, modelElKey))
    conListAssoc = set()
    conListFromAssoc = set()
    for val in modelD.values():
        for v in val:
            key = v.get('id')
            anid = str(collection) + '/' + str(key)
            conList = v.get('associationsTo')
            conFromList = v.get('associationsFrom')
            for c in conList:
                clkey = c.get('targetID')
                clName = c.get('type')
                clid = str(collection) + '/' + str(clkey)
                if ((clid, anid) not in conListAssoc):
                    conListAssoc.add((clid, anid))
                    storeAssocArango(collectionAssoc, clid, anid, clName,
                                     client)
            for c in conFromList:
                clkey = c.get('targetID')
                clName = c.get('type')
                clid = str(collection) + '/' + str(clkey)
                if ((anid, clid) not in conListFromAssoc):
                    conListFromAssoc.add((anid, clid))
                    storeAssocArango(collectionAssoc, anid, clid, clName,
                                     client)