4. Meaningfull logging.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "To provide meaningfull logging we need to provide the customer with names instead of IP adresses\n",
    "\n",
    "Doing this will not only speed up the process of finding a user and malicous activities but will also prevent false changes due to IP leases.\n",
    "\n",
    "This code will add a row to the dataframe for now to show how it works but should perform realtime during live monitoring."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "import pandas as pd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false,
    "scrolled": true
   },
   "outputs": [],
   "source": [
    "smb_cmd = pd.read_csv(\"data/smb_cmd.csv\", sep=\"\\t\", na_values=\"-\", parse_dates=[0])\n",
    "smb_cmd.columns = [ts, uid, id.orig_h, id.orig_p, id.resp_h, id.resp_p, command, sub_command, argument, status, rtt, version, username, tree, tree_service, blob]\n",
    "kerberos.fillna(0, inplace=True)\n",
    "print smb_cmd.shape"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "print smb_cmd[smb_cmd[\"username\"] != 0].shape\n",
    "print smb_cmd[smb_cmd[\"username\"] != 0].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "kerberos = pd.read_csv(\"data/kerberos.csv\", sep=\"\\t\", na_values=\"-\", parse_dates=[0, 11, 12])\n",
    "kerberos.columns = [\"ts\", \"uid\", \"id.orig_h\", \"id.orig_p\", \"id.resp_h\", \"id.resp_p\", \"request_type\", \"client\", \"service\", \"success\", \"error_msg\", \"from\", \"till\", \"cipher\", \"forwardable\", \"renewable\", \"client_cert_subject\", \"client_cert_fuid\", \"server_cert_subject\", \"server_cert_fuid\"]\n",
    "kerberos.fillna(0, inplace=True)\n",
    "print kerberos.shape\n",
    "\n",
    "def ip_to_name_kerberos(ip):\n",
    "    try:\n",
    "        maxloc =  kerberos[\"ts\"][kerberos[\"id.orig_h\"] == ip][kerberos[\"client\"] != 0].argmax()\n",
    "        name = kerberos.loc[maxloc][\"client\"]\n",
    "        return name.split(\"/\")[0].lower()\n",
    "    except:\n",
    "        return \"unknown\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "print ip_to_name(\"IP address\")"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "bro_logs = pd.read_pickle(\"data/bro_logs_filtered.pkl\")\n",
    "\n",
    "bro_logs_read = bro_logs[bro_logs[\"action\"] == \"SMB::FILE_READ\"]\n",
    "print bro_logs_read.head(10)\n",
    "bro_logs_read[\"user\"] = bro_logs_read[\"id.orig_h\"].apply(ip_to_name)\n",
    "print bro_logs_read.head(10)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": false
   },
   "outputs": [],
   "source": [
    "print bro_logs_read[\"user\"].value_counts()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 2",
   "language": "python",
   "name": "python2"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 2
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython2",
   "version": "2.7.6"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 0
}