コード例 #1
0
ファイル: triggers.py プロジェクト: AntBean/alienvault-ossim
    def evaluate(self):
        """Evaluates the condition
        :returns True on success, False otherwise
        """
        # get values to retrieve:
        # $monitor.variable

        search = self.__regex_monitor.findall(self.when)
        eval_conditions = []

        logger.info("Running condition... %s" % self.name)
        self.purge_messages()

        result_set = get_all_monitor_data()
        component_monitors = {}

        for monitor_data in result_set:
            if not component_monitors.has_key(monitor_data.component_id):
                component_monitors[monitor_data.component_id] = {}

            if not component_monitors[monitor_data.component_id].has_key(monitor_data.monitor_id):
                component_monitors[monitor_data.component_id][monitor_data.monitor_id] = json.loads(monitor_data.data)

        logger.info("Let's start working... %s" % self.name)
        #For each component evaluates the condition
        for component_id, monitors in component_monitors.iteritems():
            replacements = {}
            for m in search:
                if len(m) < 2:
                    continue
                #m[0] = monitor name
                #m[1] = param_name
                monitor_name = m[0]
                param_name = m[1]
                if monitor_name in self.__AVAILABLE_MONITORS.keys():
                    monitor_id = self.__AVAILABLE_MONITORS[monitor_name]
                    monitor_data = None
                    try:
                        monitor_data = monitors[monitor_id]
                        #logger.info(monitor_data)
                    except KeyError:
                        monitor_data = None
                    if not monitor_data:
                        continue

                    if param_name in monitor_data:
                        replacements["$%s.%s" % (monitor_name, param_name)] = monitor_data[param_name]

            if len(replacements) == len(search):
                condition = self.when
                for replacement, new_value in replacements.iteritems():
                    condition = condition.replace(replacement, str(new_value))
                if eval(condition):
                    #logger.info("Condition (%s) evaluated to TRUE -> Send message" % self.when)
                    #TODO: Modify yaml syntax to specify the component type
                    self.append_trigger_message(component_id, 'system', self.message_id, json.dumps({"condition":condition}))

        logger.info("Condition has been evaluated.... Saving data..")
        self.commit_data()
コード例 #2
0
    def evaluate(self):
        """Evaluates the condition
        :returns True on success, False otherwise
        """
        # get values to retrieve:
        # $monitor.variable

        search = self.__regex_monitor.findall(self.when)
        eval_conditions = []

        logger.info("Running condition... %s" % self.name)
        self.purge_messages()

        result_set = get_all_monitor_data()
        component_monitors = {}

        for monitor_data in result_set:
            if not component_monitors.has_key(monitor_data.component_id):
                component_monitors[monitor_data.component_id] = {}

            if not component_monitors[monitor_data.component_id].has_key(
                    monitor_data.monitor_id):
                component_monitors[monitor_data.component_id][
                    monitor_data.monitor_id] = json.loads(monitor_data.data)

        logger.info("Let's start working... %s" % self.name)
        #For each component evaluates the condition
        for component_id, monitors in component_monitors.iteritems():
            replacements = {}
            for m in search:
                if len(m) < 2:
                    continue
                #m[0] = monitor name
                #m[1] = param_name
                monitor_name = m[0]
                param_name = m[1]
                if monitor_name in self.__AVAILABLE_MONITORS.keys():
                    monitor_id = self.__AVAILABLE_MONITORS[monitor_name]
                    monitor_data = None
                    try:
                        monitor_data = monitors[monitor_id]
                        #logger.info(monitor_data)
                    except KeyError:
                        monitor_data = None
                    if not monitor_data:
                        continue

                    if param_name in monitor_data:
                        replacements["$%s.%s" %
                                     (monitor_name,
                                      param_name)] = monitor_data[param_name]

            if len(replacements) == len(search):
                condition = self.when
                for replacement, new_value in replacements.iteritems():
                    condition = condition.replace(replacement, str(new_value))
                if eval(condition):
                    #logger.info("Condition (%s) evaluated to TRUE -> Send message" % self.when)
                    #TODO: Modify yaml syntax to specify the component type
                    self.append_trigger_message(
                        component_id, 'system', self.message_id,
                        json.dumps({"condition": condition}))

        logger.info("Condition has been evaluated.... Saving data..")
        self.commit_data()
コード例 #3
0
    def evaluate(self):
        """Evaluates the condition
        :returns True on success, False otherwise
        """
        # Get the list of parameters to be evaluate for each monitor on the condition
        monitor_parameters, total_parameters_in_condition = self.get_monitor_and_parameters_to_be_evaluated()
        """
        {
          "1": {
            "name": "MONITOR_DROPPED_PACKAGES",
            "parameters": [
              "packet_loss"
            ]
          },
          "2": {
            "name": "MONITOR_CPU_LOAD",
            "parameters": [
              "cpu_load"
            ]
          }
        }
        """
        logger.info("Running trigger condition... %s" % self.name)

        # Retrieve the information from the monitors that the condition are related with.
        result_set = get_all_monitor_data(monitor_parameters.keys())
        if len(result_set) == 0:
            self.purge_messages()
            return True
        if total_parameters_in_condition == 0:
            self.purge_messages()
            return True
        # Group by component
        component_monitors = {}
        for monitor in result_set:
            monitor_id = monitor.monitor_id
            # Check whether the monitor id is on the monitor to be evaluete for this condition
            if monitor_id not in monitor_parameters.keys():
                continue
            monitor_name = monitor_parameters[monitor_id]['name']
            monitor_data = json.loads(monitor.data)
            monitor_component_type = monitor.component_type
            component_id = get_uuid_string_from_bytes(monitor.component_id)
            if component_id not in component_monitors:
                component_monitors[component_id] = []
            monitor_hash = {"monitor_id": monitor_id,
                            "monitor_name": monitor_name,
                            "monitor_data": monitor_data,
                            "monitor_component_type": monitor_component_type}
            component_monitors[component_id].append(monitor_hash)
        #print (json.dumps(component_monitors))
        for component, component_monitors in component_monitors.iteritems():
            replacements = {}
            for monitor_info in component_monitors:
                monitor_id = monitor_info["monitor_id"]
                monitor_name = monitor_info["monitor_name"]
                monitor_data = monitor_info["monitor_data"]
                monitor_component_type = monitor_info["monitor_component_type"]
                parameters_to_be_evaluated = monitor_parameters[monitor_id]['parameters']
                for parameter in parameters_to_be_evaluated:
                    # print ("Para %s" % parameter)
                    #print (monitor_data)
                    if parameter in monitor_data:
                        # logger.info("*****\n%s\n%s\n*****\n" % (parameter, monitor_data))
                        if not isinstance(monitor_data[parameter], dict):
                            replace_string = "$%s.%s" % (monitor_name, parameter)
                        #print (replace_string)
                            replace_value = monitor_data[parameter]
                            replacements[replace_string] = replace_value
                        else:
                            if 'subparameters' in monitor_parameters[monitor_id].keys():
                                for subparameter in monitor_parameters[monitor_id]['subparameters'][parameter]:
                                    replace_string = "$%s.%s.%s" % (monitor_name, parameter, subparameter)
                                    replace_value = monitor_data[parameter][subparameter]
                                    replacements[replace_string] = replace_value

            #print ("Total %s " % total_parameters_in_condition)
            #print ("R: %s" % replacements)
            if total_parameters_in_condition == len(replacements.keys()):  # We can evaluate the condition
                condition = self.when
                for replacement, new_value in replacements.iteritems():
                    if isinstance(new_value, unicode) or isinstance(new_value, str):
                        new_value = '\"' + new_value + '\"'
                    condition = condition.replace(replacement, str(new_value))
                #print (condition)
                if eval(condition):
                    self.__trigger_messages.append(component)
                    if not self.trigger_message(component, monitor_component_type, self.message_id, json.dumps(monitor_data)):
                        logger.error("Cannot insert the new notification")
                        print("Cannot insert the new notification")

        self.purge_messages()
        logger.info("Condition has been evaluated.... Saving data..")
        return True
コード例 #4
0
ファイル: triggers.py プロジェクト: qiwihui/alienvault-ossim
    def evaluate(self):
        """Evaluates the condition
        :returns True on success, False otherwise
        """
        # Get the list of parameters to be evaluate for each monitor on the condition
        monitor_parameters, total_parameters_in_condition = self.get_monitor_and_parameters_to_be_evaluated()
        """
        {
          "1": {
            "name": "MONITOR_DROPPED_PACKAGES",
            "parameters": [
              "packet_loss"
            ]
          },
          "2": {
            "name": "MONITOR_CPU_LOAD",
            "parameters": [
              "cpu_load"
            ]
          }
        }
        """
        logger.info("Running trigger condition... %s" % self.name)

        # Retrieve the information from the monitors that the condition are related with.
        result_set = get_all_monitor_data(monitor_parameters.keys())
        if len(result_set) == 0:
            self.purge_messages()
            return True
        if total_parameters_in_condition == 0:
            self.purge_messages()
            return True
        # Group by component
        component_monitors = {}
        for monitor in result_set:
            monitor_id = monitor.monitor_id
            # Check whether the monitor id is on the monitor to be evaluete for this condition
            if monitor_id not in monitor_parameters.keys():
                continue
            monitor_name = monitor_parameters[monitor_id]["name"]
            monitor_data = json.loads(monitor.data)
            monitor_component_type = monitor.component_type
            component_id = get_uuid_string_from_bytes(monitor.component_id)
            if component_id not in component_monitors:
                component_monitors[component_id] = []
            monitor_hash = {
                "monitor_id": monitor_id,
                "monitor_name": monitor_name,
                "monitor_data": monitor_data,
                "monitor_component_type": monitor_component_type,
            }
            component_monitors[component_id].append(monitor_hash)
        # print (json.dumps(component_monitors))
        for component, component_monitors in component_monitors.iteritems():
            replacements = {}
            for monitor_info in component_monitors:
                monitor_id = monitor_info["monitor_id"]
                monitor_name = monitor_info["monitor_name"]
                monitor_data = monitor_info["monitor_data"]
                monitor_component_type = monitor_info["monitor_component_type"]
                parameters_to_be_evaluated = monitor_parameters[monitor_id]["parameters"]
                for parameter in parameters_to_be_evaluated:
                    # print ("Para %s" % parameter)
                    # print (monitor_data)
                    if parameter in monitor_data:
                        # logger.info("*****\n%s\n%s\n*****\n" % (parameter, monitor_data))
                        if not isinstance(monitor_data[parameter], dict):
                            replace_string = "$%s.%s" % (monitor_name, parameter)
                            # print (replace_string)
                            replace_value = monitor_data[parameter]
                            replacements[replace_string] = replace_value
                        else:
                            if "subparameters" in monitor_parameters[monitor_id].keys():
                                for subparameter in monitor_parameters[monitor_id]["subparameters"][parameter]:
                                    replace_string = "$%s.%s.%s" % (monitor_name, parameter, subparameter)
                                    replace_value = monitor_data[parameter][subparameter]
                                    replacements[replace_string] = replace_value

            # print ("Total %s " % total_parameters_in_condition)
            # print ("R: %s" % replacements)
            if total_parameters_in_condition == len(replacements.keys()):  # We can evaluate the condition
                condition = self.when
                for replacement, new_value in replacements.iteritems():
                    if isinstance(new_value, unicode) or isinstance(new_value, str):
                        new_value = '"' + new_value + '"'
                    condition = condition.replace(replacement, str(new_value))
                # print (condition)
                if eval(condition):
                    self.__trigger_messages.append(component)
                    if not self.trigger_message(
                        component, monitor_component_type, self.message_id, json.dumps(monitor_data)
                    ):
                        logger.error("Cannot insert the new notification")
                        print("Cannot insert the new notification")

        self.purge_messages()
        logger.info("Condition has been evaluated.... Saving data..")
        return True