Re: [Snort-users] Snort/mysql/acid and dshield.org

Jonathan,

Try this... let me know your thoughts/questions.


-Dusty

==================================

#!/usr/bin/perl
#----------------------------------------
# name: dshield.pl
#
# description: script to send snort alert information from a mysql db
to dshield.org
#
# comments: dusty hall, halljer@<NOSPAM>auburn.edu
#----------------------------------------

use strict;
use DBI;
use Mail::Sender;

my $to = "reports\@dshield.org";
#my $to = "";
my $from = "";
my $smtp = "",
my $dshield_id = "";
my $tz = "-06:00";
my $db_name = "";
my $ds = "dbi:mysql:$db_name";
my $db_user = "";
my $db_pass = "";
my $db = DBI->connect($ds, $db_user, $db_pass) or die $DBI::errstr;

my ($time_select,$exec_time_select,$start_time);
my
($sid,$cid,$timestamp,$src_ip,$src_port,$dst_ip,$d st_port,$proto,$random);

$start_time = `date --date='2 hours ago' +'%Y-%m-%d %H:00'`;
chomp $start_time;

# without rand() function, you'll need to change the bind statement
too!
#$time_select = "select acid_event.sid, acid_event.cid, timestamp,
inet_ntoa(acid_event.ip_src), acid_event.layer4_sport,
inet_ntoa(acid_event.ip_dst), acid_event.layer4_dport,
acid_event.ip_proto FROM acid_event WHERE timestamp > '$start_time'
order by timestamp";

# with rand() function
$time_select = "select acid_event.sid, acid_event.cid, timestamp,
inet_ntoa(acid_event.ip_src), acid_event.layer4_sport,
inet_ntoa(acid_event.ip_dst), acid_event.layer4_dport,
acid_event.ip_proto, rand(acid_event.cid) as random FROM acid_event
WHERE timestamp > '$start_time' order by random limit 1000";

$exec_time_select = $db->prepare($time_select);
$exec_time_select->execute();
#$exec_time_select->bind_columns(undef,\$sid,\$cid,\$timestamp,\$src_ ip,\$src_port,\$dst_ip,\$dst_port,\$proto);
$exec_time_select->bind_columns(undef,\$sid,\$cid,\$timestamp,\$src_ ip,\$src_port,\$dst_ip,\$dst_port,\$proto,\$random );

my $sender = new Mail::Sender{
smtp => "$smtp",
from => "$from"};

$sender->OpenMultipart({to => "$to",
cc => "$from",
subject => "FORMAT DSHIELD USERID $dshield_id
TZ $tz"
});

while ($exec_time_select->fetch) {

$sender->SendEnc("\n$timestamp
$tz\t$dshield_id\t1\t$src_ip\t$src_port\t$dst_ip\t $dst_port\t$proto");

}

print $Mail::Sender::Error;

$sender->Close();

$exec_time_select->finish;
=======================================

>>> "Miner, Jonathan W" <jonathan.w.miner@baesystems.com> 3/1/2004
8:18:01 AM >>>
Hello -

I've gotten snort/mysql/acid working fine on Solaris 9. Thanks to the
docs
on the Snort.org website!

My question... is there anyone that has written the sql code needed to
pull
the data out of the database and send it to dshield.org?

Thanks


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users


-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users