コード例 #1
0
ファイル: sensor.py プロジェクト: chifflier/prewikka
    def render(self):
        for analyzerid in self.parameters["analyzerid"]:
            if self.parameters.has_key("alerts"):
                criteria = "alert.analyzer.analyzerid == '%s'" % utils.escape_criteria(analyzerid)
                self.env.idmef_db.deleteAlert(self.env.idmef_db.getAlertIdents(criteria))

            if self.parameters.has_key("heartbeats"):
                criteria = "heartbeat.analyzer(-1).analyzerid == '%s'" % utils.escape_criteria(analyzerid)
                self.env.idmef_db.deleteHeartbeat(self.env.idmef_db.getHeartbeatIdents(criteria))

        SensorListing.render(self)
コード例 #2
0
ファイル: messagesummary.py プロジェクト: 4sp1r3/prewikka
def getUriCriteria(parameters):
    if not parameters.has_key("messageid"):
        return None

    if parameters.has_key("analyzerid"):
        criteria = "alert.analyzer(-1).analyzerid = '%s' &&" % utils.escape_criteria(parameters["analyzerid"])
    else:
        criteria = ""

    criteria += "alert.messageid = '%s'" % utils.escape_criteria(parameters["messageid"])

    return criteria
コード例 #3
0
ファイル: stats.py プロジェクト: chifflier/prewikka
    def _addTimelineChart(self, title, value_name, width, height, path, criteria, limit=-1, names_and_colors={}, allow_stacked=False, value_callback=None, zoom_type=None):
        self._path = path
        self._limit = limit
        self._value_callback = value_callback
        self._criteria = criteria
        self._zoom_type = zoom_type
        self._names_and_colors = names_and_colors

        base_url = self._getBaseURL()
        chart = { "title": title, "value_name": value_name }

        if limit > 0:
            res = self.env.idmef_db.getValues(self._getSelection(), criteria = criteria, limit=self._limit)

            c = u""
            for name, count in res:
                if c:
                    c += " || "

                if name:
                    c += "%s = '%s'" % (self._path, utils.escape_criteria(name))
                else:
                    c += "! %s" % (self._path)
            if c:
                criteria.append(c)

        timeline = self._generateTimeline(self.user, width, height)
        timeline.render(title)

        chart["chart"] = timeline
        self.dataset["charts"].append(chart)
        self.dataset["zoom"] = self.parameters.get("zoom", None)
コード例 #4
0
ファイル: filter.py プロジェクト: Prelude-SIEM/prewikka
    def _replace(self, element):
        element = element.group(1)
        if element in ("and", "AND", "&&"):
            return "&&"

        if element in ("or", "OR", "||"):
            return "||"

        if not element in self.elements:
            raise error.PrewikkaUserError(
                _("Invalid filter element"),
                N_("Invalid filter element '%s' referenced from filter formula", element))

        prev_val = self.elements[element][2]
        elements = self.elements[element]
        for i in hookmanager.trigger("HOOK_FILTER_CRITERIA_LOAD", elements):
            if i:
                elements = i

        criteria, operator, value = elements
        if value == prev_val:
            value = "'%s'" % utils.escape_criteria(utils.filter_value_adjust(operator, value))

        if self.type:
            criteria = ".".join((self._typetbl[self.type], criteria))

        return "%s %s (%s)" % (criteria, operator, value)
コード例 #5
0
 def _applyInlineFilters(self, criteria):
     filter_found = False
     for column, path in (("name", "heartbeat.analyzer(-1).name"),
                          ("model", "heartbeat.analyzer(-1).model"),
                          ("address", "heartbeat.analyzer(-1).node.address.address"),
                          ("node_name", "heartbeat.analyzer(-1).node.name")):
         self.dataset[column + "_filtered"] = False
         if not filter_found:
             if self.parameters.has_key(path):
                 criteria.append("%s == '%s'" % (path, utils.escape_criteria(self.parameters[path])))
                 self.dataset[column + "_filtered"] = True
                 filter_found = True
コード例 #6
0
ファイル: Filter.py プロジェクト: chifflier/prewikka
    def _replace(self, element):
        element = element.group(1)
        if element in ("and", "AND", "&&"):
            return "&&"

        if element in ("or", "OR", "||"):
            return "||"

        if not self.elements.has_key(element):
            raise Error(_("Invalid filter element '%s' referenced from filter formula") % element)

        criteria, operator, value = self.elements[element]
        return "%s %s '%s'" % (criteria, operator, utils.escape_criteria(value))
コード例 #7
0
ファイル: agents.py プロジェクト: Prelude-SIEM/prewikka
    def _get_analyzers(self):
        criteria = None
        if "filter_path" in self.parameters:
            criteria = "%s == '%s'" % (self.parameters["filter_path"],
                                       utils.escape_criteria(self.parameters["filter_value"]))

        for (analyzerid,) in env.idmef_db.getValues(["heartbeat.analyzer(-1).analyzerid/group_by"], criteria):
            analyzer, heartbeat = env.idmef_db.getAnalyzer(analyzerid)
            status, status_text = utils.get_analyzer_status_from_latest_heartbeat(
                heartbeat, self._heartbeat_error_margin
            )

            if self.parameters["status"] and status not in self.parameters["status"]:
                continue

            delta = float(heartbeat.get("create_time")) - time.time()

            parameters = {"heartbeat.analyzer(-1).analyzerid": analyzerid}
            heartbeat_listing = utils.create_link(view.getViewPath("HeartbeatListing"), parameters)

            parameters = {"analyzer_object_0": "alert.analyzer.analyzerid",
                          "analyzer_operator_0": "=",
                          "analyzer_value_0": analyzerid}
            alert_listing = utils.create_link(view.getViewPath("AlertListing"), parameters)

            parameters = {"analyzerid": analyzerid}
            heartbeat_analyze = utils.create_link(self.view_path + "/HeartbeatAnalyze", parameters)

            node_name = analyzer["node.name"] or _("Node name n/a")
            osversion = analyzer["osversion"] or _("OS version n/a")
            ostype = analyzer["ostype"] or _("OS type n/a")

            yield {"id": analyzerid,
                   "label": "%s - %s %s" % (node_name, ostype, osversion),
                   "location": analyzer["node.location"] or _("Node location n/a"),
                   "node": node_name,
                   "name": analyzer["name"],
                   "model": analyzer["model"],
                   "class": analyzer["class"],
                   "version": analyzer["version"],
                   "latest_heartbeat": localization.format_timedelta(delta, add_direction=True),
                   "status": status,
                   "status_text": status_text,
                   "links": [
                       {"text": _("Alert listing"), "link": alert_listing},
                       {"text": _("Heartbeat listing"), "link": heartbeat_listing},
                       {"text": _("Heartbeat analysis"), "link": heartbeat_analyze,
                        "class": "widget-link", "title": _("Heartbeat analysis")},
                   ]}
コード例 #8
0
ファイル: sensor.py プロジェクト: chifflier/prewikka
    def render(self):
        analyzers = { }

        criteria = None
        if self.parameters.has_key("filter_path"):
            criteria = "%s == '%s'" % (self.parameters["filter_path"],
                                       utils.escape_criteria(self.parameters["filter_value"]))

        locations = { }
        nodes = { }

        for analyzerid in self.env.idmef_db.getAnalyzerids():
            analyzer = self.env.idmef_db.getAnalyzer(analyzerid)

            parameters = { "analyzerid": analyzer["analyzerid"] }
            analyzer["alert_listing"] = utils.create_link("sensor_alert_listing", parameters)
            analyzer["heartbeat_listing"] = utils.create_link("sensor_heartbeat_listing", parameters)
            analyzer["heartbeat_analyze"] = utils.create_link("heartbeat_analyze", parameters)

            if analyzer["node_name"]:
                analyzer["node_name_link"] = utils.create_link(self.view_name,
                                                               { "filter_path": "heartbeat.analyzer(-1).node.name",
                                                                 "filter_value": analyzer["node_name"] })

            if analyzer["node_location"]:
                analyzer["node_location_link"] = utils.create_link(self.view_name,
                                                                   { "filter_path": "heartbeat.analyzer(-1).node.location",
                                                                     "filter_value": analyzer["node_location"] })

            node_key = ""
            for i in range(len(analyzer["node_addresses"])):
                addr = analyzer["node_addresses"][i]
                node_key += addr

                analyzer["node_addresses"][i] = {}
                analyzer["node_addresses"][i]["value"] = addr
                analyzer["node_addresses"][i]["inline_filter"] = utils.create_link(self.view_name,
                                                                   { "filter_path": "heartbeat.analyzer(-1).node.address.address",
                                                                     "filter_value": addr })

                analyzer["node_addresses"][i]["host_commands"] = []
                for command in self.env.host_commands.keys():
                    analyzer["node_addresses"][i]["host_commands"].append((command.capitalize(),
                                                                           utils.create_link("Command",
                                                                                             { "origin": self.view_name,
                                                                                               "command": command, "host": addr })))

            analyzer["status"], analyzer["status_meaning"] = \
                                get_analyzer_status_from_latest_heartbeat(analyzer["last_heartbeat_status"],
                                                                          analyzer["last_heartbeat_time"],
                                                                          analyzer["last_heartbeat_interval"],
                                                                          self._heartbeat_error_margin)

            analyzer["last_heartbeat_time"] = utils.time_to_ymdhms(time.localtime(int(analyzer["last_heartbeat_time"]))) + \
                                              " %+.2d:%.2d" % utils.get_gmt_offset()

            node_location = analyzer["node_location"] or _("Node location n/a")
            node_name = analyzer.get("node_name") or _("Node name n/a")
            osversion = analyzer["osversion"] or _("OS version n/a")
            ostype = analyzer["ostype"] or _("OS type n/a")
            addresses = analyzer["node_addresses"]

            node_key = node_name + osversion + ostype

            if not locations.has_key(node_location):
                locations[node_location] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0, "nodes": { } }
            else:
                locations[node_location]["total"] += 1

            if not locations[node_location]["nodes"].has_key(node_key):
                locations[node_location]["nodes"][node_key] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0,
                                                                "analyzers": [ ],
                                                                "node_name": node_name, "node_location": node_location,
                                                                "ostype": ostype, "osversion": osversion,
                                                                "node_addresses": addresses, "node_key": node_key }
            else:
                locations[node_location]["nodes"][node_key]["total"] += 1

            status = analyzer["status"]
            locations[node_location][status] += 1
            locations[node_location]["nodes"][node_key][status] += 1

            if status == "missing" or status == "unknown":
                locations[node_location]["nodes"][node_key]["analyzers"].insert(0, analyzer)
            else:
                locations[node_location]["nodes"][node_key]["analyzers"].append(analyzer)

        self.dataset["locations"] = locations
コード例 #9
0
ファイル: agents.py プロジェクト: 4sp1r3/prewikka
    def render(self):
        analyzers = { }

        criteria = None
        if self.parameters.has_key("filter_path"):
            criteria = "%s == '%s'" % (self.parameters["filter_path"],
                                       utils.escape_criteria(self.parameters["filter_value"]))

        locations = { }
        nodes = { }

        for (analyzerid,) in env.idmef_db.getValues(["heartbeat.analyzer(-1).analyzerid/group_by"], criteria):
            analyzer, heartbeat = env.idmef_db.getAnalyzer(analyzerid)

            parameters = { "analyzerid": analyzer["analyzerid"] }
            analyzer.alert_listing = utils.create_link(view.getViewPath("SensorAlertListing"), parameters)
            analyzer.heartbeat_listing = utils.create_link(view.getViewPath("SensorHeartbeatListing"), parameters)
            analyzer.heartbeat_analyze = utils.create_link(self.view_path + "/HeartbeatAnalyze", parameters)

            node_key = ""
            addresses = []
            for addr in analyzer["node.address(*).address"]:
                node_key += addr

                address = {}
                address["value"] = addr
                address["inline_filter"] = utils.create_link(self.view_path,
                                                             { "filter_path": "heartbeat.analyzer(-1).node.address(*).address",
                                                               "filter_value": addr })

                address["host_links"] = []
                for typ, linkname, link, widget in env.hookmgr.trigger("HOOK_LINK", addr):
                    if typ == "host":
                        address["host_links"].append((linkname, link, widget))

                if "host" in env.url:
                    for urlname, url in env.url["host"].items():
                        address["host_links"].append((urlname.capitalize(), url.replace("$host", addr), False))

                addresses.append(address)

            analyzer.model_inline_filter = utils.create_link(self.view_path, { "filter_path": "heartbeat.analyzer(-1).model",
                                                                               "filter_value": analyzer["model"] })

            analyzer.status, analyzer.status_meaning = \
                                get_analyzer_status_from_latest_heartbeat(heartbeat, self._heartbeat_error_margin)

            delta = float(heartbeat.get("create_time")) - time.time()
            analyzer.last_heartbeat_time = localization.format_timedelta(delta, add_direction=True)

            node_location = analyzer["node.location"] or _("Node location n/a")
            node_name = analyzer.get("node.name") or _("Node name n/a")
            osversion = analyzer["osversion"] or _("OS version n/a")
            ostype = analyzer["ostype"] or _("OS type n/a")

            node_key = node_name + osversion + ostype

            if not locations.has_key(node_location):
                locations[node_location] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0, "nodes": { } }
            else:
                locations[node_location]["total"] += 1

            if not locations[node_location]["nodes"].has_key(node_key):
                locations[node_location]["nodes"][node_key] = { "total": 1, "missing": 0, "unknown": 0, "offline": 0, "online": 0,
                                                                "analyzers": [ ],
                                                                "node.name": node_name, "node.location": node_location,
                                                                "ostype": ostype, "osversion": osversion,
                                                                "node_addresses": addresses }
            else:
                locations[node_location]["nodes"][node_key]["total"] += 1

            locations[node_location][analyzer.status] += 1
            locations[node_location]["nodes"][node_key][analyzer.status] += 1

            if analyzer.status in ["missing", "unknown"]:
                locations[node_location]["nodes"][node_key]["analyzers"].insert(0, analyzer)
            else:
                locations[node_location]["nodes"][node_key]["analyzers"].append(analyzer)

        self.dataset["locations"] = locations