示例#1
0
    def run(self):
        # Connect to rabbit
        credentials = pika.PlainCredentials(
            self.config['Rabbit']['username'],
            self.config['Rabbit']['password'])
        self.connection = pika.BlockingConnection(
            pika.ConnectionParameters(host=self.config['Rabbit']['host'], credentials=credentials))
        self.channel = self.connection.channel()

        # Setup recurring search
        rpcSender = RPCSender(self.config)
        resp = json.loads(rpcSender.send_request(
            'SEARCH',
            'honeycomb',
            {"QUERY": self.query, "TIMESCALE": 604800},
            '',
            'pheromonealerter',
            key='honeycomb'))

        self.channel.basic_consume(
            self.on_message,
            queue=resp['data']['queue'],
            no_ack=True)

        self.ready.set()

        self.channel.start_consuming()
示例#2
0
    def new(self, msg, resp):
        worker = self.workers.new()

        sender = RPCSender(self.config)
        r = sender.channel.queue_declare()
        q = r.method.queue

        machine = ProcHandler(
            self.config,
            Alerter(
                self.config,
                msg['data']['query'],
                msg['data']['time'],
                msg['data']['quantity'],
                msg['data']['message'],
                msg['data']['user']),
            q)
        machine.start()

        req = json.loads(sender.send_request(
            'GET',
            'hive',
            {'variables': ['uuid']},
            '',
            '',
            key=q))

        print req

        worker.UUID = req['uuid']
        worker.CONTROLQUEUE = q
        worker.QUERY = msg['data']['query']
        worker.TIME = msg['data']['time']
        worker.QUANTITY = msg['data']['quantity']
        worker.MESSAGE = msg['data']['message']

        self.workers.save(worker)

        resp.respond({worker.UUID: worker.to_hash()})
示例#3
0
    def run(self):
        # Connect to rabbit
        credentials = pika.PlainCredentials(
            self.config['Rabbit']['username'],
            self.config['Rabbit']['password'])
        self.connection = pika.BlockingConnection(
            pika.ConnectionParameters(host=self.config['Rabbit']['host'], credentials=credentials))
        self.channel = self.connection.channel()

        # Setup queue for outputing data
        result = channel.queue_declare(exclusive=true)
        self.queue = result.method.queue

        # Push all historic data from honeycomb
        rpcSender = RPCSender(self.config)
        resp = rpcSender.send_request(
            'THINGS',
            'honeycomb',
            '{}',
            'SOMETHING',
            'timemachineworker',
            key='honeycomb')
        for log in resp.data:
            self.channel.basic_publish(
                exchange='',
                routing_key=self.queue,
                body=log)

        # Start listening for live data to forward
        result = channel.queue_declare(exclusive=true)
        self.buff = result.method.queue
        channel.queue_bind(
            exchange='apiary',
            queue=self.buff,
            routing_key='agent.*.data')
        channel.basic_consume(on_message, queue=self.buff, no_ack=True)
        channel.start_consuming()
示例#4
0
    def newsearch(self, msg, resp):
        sender = RPCSender(self.config)

        queue = sender.channel.queue_declare()
        queue_name = queue.method.queue

        results = self.searchers.mongoQuery({'QUERY': msg['data']['QUERY']})

        if len(results) > 0:
            searcher = results[0]

            sender.channel.queue_bind(
                exchange=searcher.OUTPUTEXCHANGE,
                queue=queue_name)

            req = sender.send_request(
                'SET',
                'hive',
                {'override': True},
                '',
                '',
                key=searcher.CONTROLQUEUE)
        else:
            searcher = self.searchers.new()
            r = sender.channel.queue_declare()
            q = r.method.queue
            machine = ProcHandler(
                self.config,
                Searcher(
                    self.config,
                    msg['data']['QUERY']),
                q)
            machine.start()

            req = json.loads(sender.send_request(
                'GET',
                'hive',
                {'variables': ['exchange']},
                '',
                '',
                key=q))

            searcher.OUTPUTEXCHANGE = req['exchange']
            searcher.CONTROLQUEUE = q
            searcher.QUERY = msg['data']['QUERY']

            sender.channel.queue_bind(
                exchange=searcher.OUTPUTEXCHANGE,
                queue=queue_name)

            req = sender.send_request(
                'SET',
                'hive',
                {'override': True},
                '',
                '',
                key=q)

            self.searchers.save(searcher)

        resp.respond({'queue': queue_name})
示例#5
0
data['CONTENT'] = "ERROR 128.10.10.90"
data['TYPE'] = "string"
data['EVENTTIMESTAMP'] = str(time.time())
data['METADATA'] = {}
data['METADATA']['TAGS'] = "firewall,yomama" 
data['QUERY'] = "CONTENT:\"ERROR *.*.*.*\"" 
data['TIMESCALE'] = "86400" 
data['files'] = {'PATH': "/etc/path", 'TAGS': "firewall"}
data['agents'] = ['17af7719-f759-44a5-95a6-f66d31c53f86']

data['query'] = "CONTENT:apple"
data['time'] = 600
data['quantity'] = 5
data['message'] = "HOLY MOTHER OF JEBUS"
data['user'] = "******"

sdata = data
 
config = {}
config['Rabbit'] = {}
config['Rabbit']['username'] = '******'
config['Rabbit']['password'] = '******'
config['Rabbit']['host'] = '192.168.1.106'

sender = RPCSender(config)

resp = sender.send_request('QUERY', 'hive', sdata, 'LKJABSDHBAS', 'Test Script', exchange="", key="honeycomb")
#resp = sender.send_request('NEW', 'hive', sdata, 'LKJABSDHBAS', 'Test Script', exchange="", key="pheromone")

print resp