EventStormPlugin.py
1 |
# Copyright (C) 2006 G Ramon Gomez <gene at gomezbrothers dot com>
|
---|---|
2 |
# Copyright (C) 2009-2018 CS-SI <support.prelude@c-s.fr>
|
3 |
#
|
4 |
# This file is part of the Prelude-Correlator program.
|
5 |
#
|
6 |
# This program is free software; you can redistribute it and/or modify
|
7 |
# it under the terms of the GNU General Public License as published by
|
8 |
# the Free Software Foundation; either version 2, or (at your option)
|
9 |
# any later version.
|
10 |
#
|
11 |
# This program is distributed in the hope that it will be useful,
|
12 |
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
13 |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
14 |
# GNU General Public License for more details.
|
15 |
#
|
16 |
# You should have received a copy of the GNU General Public License along
|
17 |
# with this program; if not, write to the Free Software Foundation, Inc.,
|
18 |
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
19 |
|
20 |
# Detect Eventscan:
|
21 |
# Playing multiple events from a single host against another single host
|
22 |
|
23 |
from preludecorrelator import context |
24 |
from preludecorrelator.pluginmanager import Plugin |
25 |
|
26 |
|
27 |
# Detect Eventstorm:
|
28 |
# Playing excessive events by a single host
|
29 |
class EventStormPlugin(Plugin): |
30 |
def run(self, idmef): |
31 |
print("*** %s" % context.stats())
|
32 |
source = idmef.get("alert.source(*).node.address(*).address")
|
33 |
if not source: |
34 |
return
|
35 |
|
36 |
for saddr in source: |
37 |
ctx = context.Context(("SCAN EVENTSTORM", saddr), {"expire": 120, "threshold": 150, "alert_on_expire": True}, overwrite=False, update=False, idmef=idmef, ruleid=self.name) |
38 |
if ctx.getUpdateCount() == 0: |
39 |
ctx.set("alert.correlation_alert.name", "A single host is producing an unusual amount of events") |
40 |
ctx.set("alert.classification.text", "Eventstorm") |
41 |
ctx.set("alert.assessment.impact.severity", "high") |
42 |
ctx.update(timer_rst = False)
|
43 |
else:
|
44 |
ctx.update(idmef = idmef, timer_rst = False)
|