Suricata Lua - Versionsgeschichte

Linkai.zhang am 19. September 2023 um 19:57 Uhr

2023-09-19T19:57:13Z

Linkai.zhang: /* Beispiel */

2023-09-19T19:56:37Z

Beispiel

Linkai.zhang am 19. September 2023 um 19:55 Uhr

2023-09-19T19:55:00Z

Linkai.zhang am 19. September 2023 um 19:51 Uhr

2023-09-19T19:51:47Z

Linkai.zhang am 19. September 2023 um 19:51 Uhr

2023-09-19T19:51:38Z

Linkai.zhang am 19. September 2023 um 19:51 Uhr

2023-09-19T19:51:07Z

Linkai.zhang: Die Seite wurde neu angelegt: „= Beispiel = * '''vim /etc/suricata/lua-output/http.lua''' local name = "http.log" function init (args) local needs = {} needs["protocol"] = "h…“

2023-09-19T19:50:17Z

Die Seite wurde neu angelegt: „= Beispiel = * '''vim /etc/suricata/lua-output/http.lua''' local name = "http.log" function init (args) local needs = {} needs["protocol"] = "h…“

Neue Seite

= Beispiel =

* '''vim /etc/suricata/lua-output/http.lua'''

local name = "http.log"

function init (args)
local needs = {}
needs["protocol"] = "http"
return needs
end

function setup (args)
filename = SCLogPath() .. "/" .. name
file = assert(io.open(filename, "a"))
SCLogInfo("HTTP Log Filename " .. filename)
http = 0
end

function log(args)
http_uri = HttpGetRequestUriRaw()
if http_uri == nil then
http_uri = "<unknown>"
end

http_uri = string.gsub(http_uri, "%c", ".")
http_host = HttpGetRequestHost()
if http_host == nil then
http_host = "<hostname unknown>"
end

http_host = string.gsub(http_host, "%c", ".")
http_ua = HttpGetRequestHeader("User-Agent")
if http_ua == nil then
http_ua = "<useragent unknown>"
end

http_ua = string.gsub(http_ua, "%g", ".")
timestring = SCPacketTimeString()
ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()
file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
dst_ip .. ":" .. dst_port .. "\n")
file:flush()
http = http + 1
end

function deinit (args)
SCLogInfo ("HTTP transactions logged: " .. http);
file:close(file)
end

* '''vim /etc/suricata/suricata.yaml'''

← Nächstältere Version		Version vom 19. September 2023, 19:57 Uhr
Zeile 74:		Zeile 74:
	* '''suricata -D --af-packet'''		* '''suricata -D --af-packet'''
	* '''tail -fn0 /var/log/suricata/http.log'''		* '''tail -fn0 /var/log/suricata/http.log'''
		+
		+	= Links =
		+
		+	* https://docs.suricata.io/en/suricata-6.0.1/output/lua-output.html#lua-output

@@ Zeile 54: / Zeile 54: @@
 </syntaxhighlight>
 * '''vim /etc/suricata/suricata.yaml'''
@@ Zeile 67: / Zeile 68: @@
 </syntaxhighlight>
 * '''tail -fn0 /var/log/suricata/http.log'''

@@ Zeile 1: / Zeile 1: @@
 = Beispiel =
 * '''vim /etc/suricata/lua-output/http.lua'''
@@ Zeile 57: / Zeile 58: @@
 <syntaxhighlight lang="yaml">
 outputs:
    - lua:
        enabled: yes
        scripts-dir: /etc/suricata/lua-output/
        scripts:
-         - tcp-data.lua
+         - http.lua
-        - flow.lua
+  ...
 </syntaxhighlight>

@@ Zeile 3: / Zeile 3: @@
 * '''vim /etc/suricata/lua-output/http.lua'''
-<syntaxhighlight lang="yaml">
+<syntaxhighlight lang="lua">
 local name = "http.log"

← Nächstältere Version		Version vom 19. September 2023, 19:51 Uhr
Zeile 52:		Zeile 52:

	* '''vim /etc/suricata/suricata.yaml'''		* '''vim /etc/suricata/suricata.yaml'''
		+
		+	<syntaxhighlight lang="yaml">
		+	outputs:
		+	- lua:
		+	enabled: yes
		+	scripts-dir: /etc/suricata/lua-output/
		+	scripts:
		+	- tcp-data.lua
		+	- flow.lua
		+	</syntaxhighlight>

@@ Zeile 3: / Zeile 3: @@
 * '''vim /etc/suricata/lua-output/http.lua'''
- local name = "http.log"
+<syntaxhighlight lang="yaml">
 local name = "http.log"
- function init (args)
-     local needs = {}
+function init (args)
-     needs["protocol"] = "http"
+    local needs = {}
-     return needs
+    needs["protocol"] = "http"
- end
+    return needs
 end
- function setup (args)
-     filename = SCLogPath() .. "/" .. name
+function setup (args)
-     file = assert(io.open(filename, "a"))
+    filename = SCLogPath() .. "/" .. name
-     SCLogInfo("HTTP Log Filename " .. filename)
+    file = assert(io.open(filename, "a"))
-     http = 0
+    SCLogInfo("HTTP Log Filename " .. filename)
- end
+    http = 0
 end
- function log(args)
-     http_uri = HttpGetRequestUriRaw()
+function log(args)
-     if http_uri == nil then
+    http_uri = HttpGetRequestUriRaw()
-         http_uri = "<unknown>"
+    if http_uri == nil then
-     end
+        http_uri = "<unknown>"
+    end
-     http_uri = string.gsub(http_uri, "%c", ".")
-     http_host = HttpGetRequestHost()
+    http_uri = string.gsub(http_uri, "%c", ".")
-     if http_host == nil then
+    http_host = HttpGetRequestHost()
-         http_host = "<hostname unknown>"
+    if http_host == nil then
-     end
+        http_host = "<hostname unknown>"
+    end
-     http_host = string.gsub(http_host, "%c", ".")
-     http_ua = HttpGetRequestHeader("User-Agent")
+    http_host = string.gsub(http_host, "%c", ".")
-     if http_ua == nil then
+    http_ua = HttpGetRequestHeader("User-Agent")
-         http_ua = "<useragent unknown>"
+    if http_ua == nil then
-     end
+        http_ua = "<useragent unknown>"
+    end
-     http_ua = string.gsub(http_ua, "%g", ".")
-     timestring = SCPacketTimeString()
+    http_ua = string.gsub(http_ua, "%g", ".")
-     ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()
+    timestring = SCPacketTimeString()
-     file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
+    ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()
-            http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
+    file:write (timestring .. " " .. http_host .. " [**] " .. http_uri .. " [**] " ..
-            dst_ip .. ":" .. dst_port .. "\n")
+           http_ua .. " [**] " .. src_ip .. ":" .. src_port .. " -> " ..
-     file:flush()
+           dst_ip .. ":" .. dst_port .. "\n")
-     http = http + 1
+    file:flush()
- end
+    http = http + 1
 end
- function deinit (args)
-     SCLogInfo ("HTTP transactions logged: " .. http);
+function deinit (args)
-     file:close(file)
+    SCLogInfo ("HTTP transactions logged: " .. http);
- end
+    file:close(file)
 * '''vim /etc/suricata/suricata.yaml'''