Skip to content

Commit

Permalink
Merge pull request #1468 from p-l-/prerelease
Browse files Browse the repository at this point in the history
Prerelease fixes
  • Loading branch information
p-l- committed Jan 11, 2023
2 parents 72e21f3 + 2bc6a3a commit aa06929
Show file tree
Hide file tree
Showing 9 changed files with 57 additions and 20 deletions.
39 changes: 38 additions & 1 deletion ivre/data/abuse_ch/sslbl.py

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion web/static/doc/_static/basic.css
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*
* Sphinx stylesheet -- basic theme.
*
* :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS.
* :copyright: Copyright 2007-2023 by the Sphinx team, see AUTHORS.
* :license: BSD, see LICENSE for details.
*
*/
Expand Down
2 changes: 1 addition & 1 deletion web/static/doc/_static/doctools.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*
* Base JavaScript utilities for all Sphinx HTML documentation.
*
* :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS.
* :copyright: Copyright 2007-2023 by the Sphinx team, see AUTHORS.
* :license: BSD, see LICENSE for details.
*
*/
Expand Down
2 changes: 1 addition & 1 deletion web/static/doc/_static/graphviz.css
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*
* Sphinx stylesheet -- graphviz extension.
*
* :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS.
* :copyright: Copyright 2007-2023 by the Sphinx team, see AUTHORS.
* :license: BSD, see LICENSE for details.
*
*/
Expand Down
2 changes: 1 addition & 1 deletion web/static/doc/_static/language_data.js
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
* This script contains the language-specific data used by searchtools.js,
* namely the list of stopwords, stemmer, scorer and splitter.
*
* :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS.
* :copyright: Copyright 2007-2023 by the Sphinx team, see AUTHORS.
* :license: BSD, see LICENSE for details.
*
*/
Expand Down
2 changes: 1 addition & 1 deletion web/static/doc/_static/searchtools.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
*
* Sphinx JavaScript utilities for the full-text search.
*
* :copyright: Copyright 2007-2022 by the Sphinx team, see AUTHORS.
* :copyright: Copyright 2007-2023 by the Sphinx team, see AUTHORS.
* :license: BSD, see LICENSE for details.
*
*/
Expand Down
6 changes: 3 additions & 3 deletions web/static/doc/overview/faq.html
Original file line number Diff line number Diff line change
Expand Up @@ -333,12 +333,12 @@ <h2>How can I configure iptables to get logs used by flow2db tool<a class="heade
careful with the OUTPUT rule if the logs are sent over the network!</p>
<p>On the syslog server or on each host, just run grep to collect the
data needed for the iptables flow2db parser:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$ grep -l <span class="s1">&#39;IPTABLES/&#39;</span> /var/log/syslog /var/log/kernel.log ... <span class="se">\</span>
&gt; syslog-iptables.log
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$<span class="w"> </span>grep<span class="w"> </span>-l<span class="w"> </span><span class="s1">&#39;IPTABLES/&#39;</span><span class="w"> </span>/var/log/syslog<span class="w"> </span>/var/log/kernel.log<span class="w"> </span>...<span class="w"> </span><span class="se">\</span>
<span class="w"> </span>&gt;<span class="w"> </span>syslog-iptables.log
</pre></div>
</div>
<p>Then import data to ivredb using flow2db tool:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$ ivre flow2db -t iptables syslog-iptables.log
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$<span class="w"> </span>ivre<span class="w"> </span>flow2db<span class="w"> </span>-t<span class="w"> </span>iptables<span class="w"> </span>syslog-iptables.log
</pre></div>
</div>
</section>
Expand Down
14 changes: 7 additions & 7 deletions web/static/doc/usage/flow.html
Original file line number Diff line number Diff line change
Expand Up @@ -209,22 +209,22 @@ <h2>Usage<a class="headerlink" href="#usage" title="Permalink to this heading">
<h3>Data insertion<a class="headerlink" href="#data-insertion" title="Permalink to this heading"></a></h3>
<p>There are two tools for data insertion, the first is based on Zeek
(previously known as Bro):</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$ zeek -r capture_file.pcap
$ ivre zeek2db ./*.log
$ ivre flowcli
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$<span class="w"> </span>zeek<span class="w"> </span>-r<span class="w"> </span>capture_file.pcap
$<span class="w"> </span>ivre<span class="w"> </span>zeek2db<span class="w"> </span>./*.log
$<span class="w"> </span>ivre<span class="w"> </span>flowcli
</pre></div>
</div>
<p>The second can take either argus logs or netflow logs:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$ argus -m -r capture_file.pcap -w flows.argus
$ ivre flow2db flows.argus
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$<span class="w"> </span>argus<span class="w"> </span>-m<span class="w"> </span>-r<span class="w"> </span>capture_file.pcap<span class="w"> </span>-w<span class="w"> </span>flows.argus
$<span class="w"> </span>ivre<span class="w"> </span>flow2db<span class="w"> </span>flows.argus
</pre></div>
</div>
<p>Or:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$ ivre flow2db flows.nfdump
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$<span class="w"> </span>ivre<span class="w"> </span>flow2db<span class="w"> </span>flows.nfdump
</pre></div>
</div>
<p>Or:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$ ivre flow2db -t iptables iptables-from-syslog.log
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span>$<span class="w"> </span>ivre<span class="w"> </span>flow2db<span class="w"> </span>-t<span class="w"> </span>iptables<span class="w"> </span>iptables-from-syslog.log
</pre></div>
</div>
<p>Any of these tools can be called with ‘–init’ to reinitialize the DB.</p>
Expand Down
8 changes: 4 additions & 4 deletions web/static/doc/usage/kibana.html
Original file line number Diff line number Diff line change
Expand Up @@ -232,12 +232,12 @@ <h3>Configuration<a class="headerlink" href="#configuration" title="Permalink to
are going to create a dedicated IVRE configuration file, for example
in <code class="docutils literal notranslate"><span class="pre">~/.ivre-elastic.conf</span></code>; for example, to use an Elasticsearch
server running on the local machine:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nb">echo</span> <span class="s1">&#39;DB_VIEW = &quot;elastic://127.0.0.1:9200/ivre&quot;&#39;</span> &gt; ~/.ivre-elastic.conf
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nb">echo</span><span class="w"> </span><span class="s1">&#39;DB_VIEW = &quot;elastic://127.0.0.1:9200/ivre&quot;&#39;</span><span class="w"> </span>&gt;<span class="w"> </span>~/.ivre-elastic.conf
</pre></div>
</div>
<p>Then, to use this dedicated configuration file, we just have to set
the <code class="docutils literal notranslate"><span class="pre">IVRE_CONF</span></code> environment variable:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nv">IVRE_CONF</span><span class="o">=</span>~/.ivre-elastic.conf ivre view --count
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nv">IVRE_CONF</span><span class="o">=</span>~/.ivre-elastic.conf<span class="w"> </span>ivre<span class="w"> </span>view<span class="w"> </span>--count
</pre></div>
</div>
</section>
Expand All @@ -246,8 +246,8 @@ <h3>Index creation &amp; Data insertion<a class="headerlink" href="#index-creati
<p>So now, we can create a view as we would do with any other
backend. For example, if we want to create a view using all the
records from the <code class="docutils literal notranslate"><span class="pre">nmap</span></code> and <code class="docutils literal notranslate"><span class="pre">passive</span></code> purposes:</p>
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nv">IVRE_CONF</span><span class="o">=</span>~/.ivre-elastic.conf ivre view --init &lt; /dev/null
<span class="nv">IVRE_CONF</span><span class="o">=</span>~/.ivre-elastic.conf ivre db2view
<div class="highlight-bash notranslate"><div class="highlight"><pre><span></span><span class="nv">IVRE_CONF</span><span class="o">=</span>~/.ivre-elastic.conf<span class="w"> </span>ivre<span class="w"> </span>view<span class="w"> </span>--init<span class="w"> </span>&lt;<span class="w"> </span>/dev/null
<span class="nv">IVRE_CONF</span><span class="o">=</span>~/.ivre-elastic.conf<span class="w"> </span>ivre<span class="w"> </span>db2view
</pre></div>
</div>
<p>The first command will drop any existing data, and create the index
Expand Down

0 comments on commit aa06929

Please sign in to comment.