Unified2
- Homepage
- Issues
- Documentation
- [Email](mailto:dustin.webber at gmail.com)
Description
A ruby interface for unified2 output. rUnified2 allows you to manipulate unified2 output for custom storage and/or analysis.
Features
- Monitor/Read unified2 logs & manipulate the data.
- Numerous convenience methods
- Simple & Intuitive to Use
- Supports legacy unified2 formats and the most current as of snort 2.9.1.3
- Packet data, headers, hexdumps and more.
Examples
require 'unified2'
# Unified2 Configuration
Unified2.configuration do
# Sensor Configurations
sensor :interface => 'en1',
:name => 'Unified2 Example', :id => 3
load :signatures, 'seeds/sid-msg.map'
load :generators, 'seeds/gen-msg.map'
load :classifications, 'seeds/classification.config'
end
Unified2.watch('seeds/unified2-current.log', :first) do |event|
puts event.id
puts event.severity
puts event.classification.name
puts event.signature.name
event.extras.each do |extra|
puts extra.name
puts extra.value
end
event.packets.each do |packet|
puts packet.ip_header
puts packet.protocol.header
puts packet.hexdump(:header => false, :width => 40)
end
end
Requirements
- bindata ~> 1.4.x
- hexdump: ~> 0.2.x
- packetfu: ~> 1.1.x
TODO
- Make both Event#watch and Event#read evented
- User eventmachine to monitor the file i.e modify/delete/move/symlink
Install
`$ gem install unified2`
Copyright
Copyright (c) 2011 Dustin Willis Webber
See LICENSE.txt for details.