mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-10 19:22:54 +01:00
Add localfile analyzer and tests
This commit is contained in:
79
salt/sensoroni/files/analyzers/localfile/localfile.py
Executable file
79
salt/sensoroni/files/analyzers/localfile/localfile.py
Executable file
@@ -0,0 +1,79 @@
|
||||
import json
|
||||
import helpers
|
||||
import os
|
||||
import sys
|
||||
import argparse
|
||||
import csv
|
||||
|
||||
|
||||
def checkConfigRequirements(conf):
|
||||
if "file_path" not in conf or len(conf['file_path']) == 0:
|
||||
sys.exit(126)
|
||||
else:
|
||||
return True
|
||||
|
||||
|
||||
def searchFile(artifact, csvfiles):
|
||||
dir = os.path.dirname(os.path.realpath(__file__))
|
||||
found = []
|
||||
for f in csvfiles:
|
||||
filename = dir + "/" + f
|
||||
with open(filename, "r") as csvfile:
|
||||
csvdata = csv.DictReader(csvfile)
|
||||
for row in csvdata:
|
||||
first_key = list(row.keys())[0]
|
||||
if artifact in row[first_key]:
|
||||
row.update({"filename": filename})
|
||||
found.append(row)
|
||||
if len(found) != 0:
|
||||
if len(found) == 1:
|
||||
results = found[0]
|
||||
else:
|
||||
results = found
|
||||
else:
|
||||
results = "No results"
|
||||
|
||||
return results
|
||||
|
||||
|
||||
def prepareResults(raw):
|
||||
if len(raw) > 0:
|
||||
if "No results" in raw:
|
||||
status = "ok"
|
||||
summary = "no_results"
|
||||
else:
|
||||
status = "info"
|
||||
summary = "One or more matches found."
|
||||
else:
|
||||
raw = {}
|
||||
status = "caution"
|
||||
summary = "internal_failure"
|
||||
response = raw
|
||||
results = {'response': response, 'status': status, 'summary': summary}
|
||||
return results
|
||||
|
||||
|
||||
def analyze(conf, input):
|
||||
checkConfigRequirements(conf)
|
||||
meta = helpers.loadMetadata(__file__)
|
||||
data = helpers.parseArtifact(input)
|
||||
helpers.checkSupportedType(meta, data["artifactType"])
|
||||
search = searchFile(data["value"], conf['file_path'])
|
||||
results = prepareResults(search)
|
||||
return results
|
||||
|
||||
|
||||
def main():
|
||||
dir = os.path.dirname(os.path.realpath(__file__))
|
||||
parser = argparse.ArgumentParser(description='Search CSV file for a given artifact')
|
||||
parser.add_argument('artifact', help='the artifact represented in JSON format')
|
||||
parser.add_argument('-c', '--config', metavar="CONFIG_FILE", default=dir + "/localfile.yaml", help='optional config file to use instead of the default config file')
|
||||
|
||||
args = parser.parse_args()
|
||||
if args.artifact:
|
||||
results = analyze(helpers.loadConfig(args.config), args.artifact)
|
||||
print(json.dumps(results))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
Reference in New Issue
Block a user