class SaganCrafter::Factory::IPlogger
-
Rule output
alert tcp $HOME_NET any -> any any (msg: “[PASSIVEDNS] BH1 Hit bighealthtree.com.”; content: bighealthtree.com.“; normalize: tightstack; classtype: suspicious-traffic; program: tightstack; sid:5100002; rev:2;)
Public Class Methods
new()
click to toggle source
# File lib/sagan_crafter/factory/iplogger.rb, line 10 def initialize end
Public Instance Methods
rule(ioc, feed_provider, feed_name, count, last_time)
click to toggle source
# File lib/sagan_crafter/factory/iplogger.rb, line 13 def rule(ioc, feed_provider, feed_name, count, last_time) @rule = Snort::Rule.new( { :enabled => true, :action => 'alert', :proto => 'tcp', :src => '$HOME_NET', :sport => 'any', :dir => '<>', :dst => 'any', :dport => 'any', :options => { 'msg' => "\"[#{SaganCrafter::Settings.iplogger}] #{feed_provider} #{feed_name} - #{ioc}\"", 'content' => "\"#{ioc}\"", 'sid' => XXhash.xxh32(ioc) % 1000000000 + 1000000000, 'normalize' => SaganCrafter::Settings.normalizer, 'program' => SaganCrafter::Settings.program, 'rev' => count, 'metadata' => "time #{last_time}, xxhash #{XXhash.xxh64(ioc)}" } } ) end
to_s()
click to toggle source
# File lib/sagan_crafter/factory/iplogger.rb, line 37 def to_s @rule.to_s end