class SaganCrafter::Factory::FQDNlogger

Rule output

alert tcp $HOME_NET any -> any any (msg: “[PASSIVEDNS] BH1 Hit bighealthtree.com.”; content: bighealthtree.com.“; normalize: tightstack; classtype: suspicious-traffic; program: tightstack; sid:5100002; rev:2;)

Public Class Methods

new() click to toggle source
# File lib/sagan_crafter/factory/fqdnlogger.rb, line 10
def initialize
end

Public Instance Methods

rule(ioc, feed_provider, feed_name, count, last_time) click to toggle source
# File lib/sagan_crafter/factory/fqdnlogger.rb, line 13
def rule(ioc, feed_provider, feed_name, count, last_time)
  @rule = Snort::Rule.new(
    {
      :enabled => true,
      :action => 'alert',
      :proto => 'tcp',
      :src => '$HOME_NET',
      :sport => 'any',
      :dir => '<>',
      :dst => 'any',
      :dport => 'any',
      :options => {
        'msg' => "\"[#{SaganCrafter::Settings.fqdnlogger}] #{feed_provider} #{feed_name} - #{ioc}\"",
        'content' => "\"#{ioc}\"",
        'sid' => XXhash.xxh32(ioc) % 1000000000 + 1000000000,
        'normalize' => SaganCrafter::Settings.normalizer,
        'program' => SaganCrafter::Settings.program,
        'rev' => count,
        'metadata' => "time #{last_time}, xxhash #{XXhash.xxh64(ioc)}"
        }
      }
  )
end
to_s() click to toggle source
# File lib/sagan_crafter/factory/fqdnlogger.rb, line 37
def to_s
  @rule.to_s
end