Re: Snort/mysql/acid and dshield.org

["Dusty Hall" <halljer () auburn edu>]

Jonathan,

  Try this... let me know your thoughts/questions.


-Dusty

==================================

#!/usr/bin/perl 
#----------------------------------------
# name: dshield.pl 
#
# description: script to send snort alert information from a mysql db
to dshield.org
#
# comments: dusty hall, halljer@<NOSPAM>auburn.edu
#----------------------------------------

use strict;
use DBI;
use Mail::Sender;

my $to = "reports\@dshield.org";
#my $to = "";
my $from = "";
my $smtp = "",
my $dshield_id = "";
my $tz = "-06:00";
my $db_name = "";
my $ds = "dbi:mysql:$db_name";
my $db_user = "";
my $db_pass = "";
my $db = DBI->connect($ds, $db_user, $db_pass) or die $DBI::errstr;

my ($time_select,$exec_time_select,$start_time);
my
($sid,$cid,$timestamp,$src_ip,$src_port,$dst_ip,$dst_port,$proto,$random);

$start_time = `date --date='2 hours ago' +'%Y-%m-%d %H:00'`;
chomp $start_time;

# without rand() function, you'll need to change the bind statement
too!
#$time_select = "select acid_event.sid, acid_event.cid, timestamp,
inet_ntoa(acid_event.ip_src), acid_event.layer4_sport,
inet_ntoa(acid_event.ip_dst), acid_event.layer4_dport,
acid_event.ip_proto FROM acid_event WHERE timestamp > '$start_time'
order by timestamp";

# with rand() function
$time_select = "select acid_event.sid, acid_event.cid, timestamp,
inet_ntoa(acid_event.ip_src), acid_event.layer4_sport,
inet_ntoa(acid_event.ip_dst), acid_event.layer4_dport,
acid_event.ip_proto, rand(acid_event.cid) as random FROM acid_event
WHERE timestamp > '$start_time' order by random limit 1000";

$exec_time_select = $db->prepare($time_select);
$exec_time_select->execute();
#$exec_time_select->bind_columns(undef,\$sid,\$cid,\$timestamp,\$src_ip,\$src_port,\$dst_ip,\$dst_port,\$proto);
$exec_time_select->bind_columns(undef,\$sid,\$cid,\$timestamp,\$src_ip,\$src_port,\$dst_ip,\$dst_port,\$proto,\$random);

my $sender = new Mail::Sender{
        smtp => "$smtp",
        from => "$from"};

$sender->OpenMultipart({to => "$to",
                        cc => "$from",  
                        subject => "FORMAT DSHIELD USERID $dshield_id
TZ $tz"
});

while ($exec_time_select->fetch) {

 $sender->SendEnc("\n$timestamp
$tz\t$dshield_id\t1\t$src_ip\t$src_port\t$dst_ip\t$dst_port\t$proto");

}

print $Mail::Sender::Error;

$sender->Close();

$exec_time_select->finish;
=======================================

> > > "Miner, Jonathan W" <jonathan.w.miner () baesystems com> 3/1/2004
8:18:01 AM >>>
Hello -

I've gotten snort/mysql/acid working fine on Solaris 9.  Thanks to the
docs
on the Snort.org website!

My question... is there anyone that has written the sql code needed to
pull
the data out of the database and send it to dshield.org? 

Thanks


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click 
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net 
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users 
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users