A ruby interface to the unified2 output format.
Ruby
Permalink
Failed to load latest commit information.
bin Update changelog for 0.6.0 Nov 13, 2011
example test Dec 18, 2011
lib
spec
.document
.gitignore Remove old payload require Nov 13, 2011
.rspec
.yardopts
ChangeLog.md Event method update Nov 26, 2011
LICENSE.txt update gemspec and readme Mar 18, 2011
README.md
Rakefile
gemspec.yml add rdiscount as dev dep - no idea why yard does not control this. Nov 13, 2011
unified2.gemspec add option for initial event_id incrementation Mar 8, 2011

README.md

Unified2

Description

A ruby interface for unified2 output. rUnified2 allows you to manipulate unified2 output for custom storage and/or analysis.

Features

  • Monitor/Read unified2 logs & manipulate the data.
  • Numerous convenience methods
  • Simple & Intuitive to Use
  • Supports legacy unified2 formats and the most current as of snort 2.9.1.3
  • Packet data, headers, hexdumps and more.

Examples

require 'unified2'

# Unified2 Configuration
Unified2.configuration do

  # Sensor Configurations
  sensor :interface => 'en1',
    :name => 'Unified2 Example', :id => 3

  load :signatures, 'seeds/sid-msg.map'

  load :generators, 'seeds/gen-msg.map'

  load :classifications, 'seeds/classification.config'

end

Unified2.watch('seeds/unified2-current.log', :first) do |event|

  puts event.id

  puts event.severity

  puts event.classification.name

  puts event.signature.name

  event.extras.each do |extra|
    puts extra.name
    puts extra.value
  end

  event.packets.each do |packet|
    puts packet.ip_header
    puts packet.protocol.header
    puts packet.hexdump(:header => false, :width => 40)
  end

end

Requirements

  • bindata ~> 1.4.x
  • hexdump: ~> 0.2.x
  • packetfu: ~> 1.1.x

TODO

  • Make both Event#watch and Event#read evented
  • User eventmachine to monitor the file i.e modify/delete/move/symlink

Install

`$ gem install unified2`

Copyright

Copyright (c) 2011 Dustin Willis Webber

See LICENSE.txt for details.