This python script uses snort's database event logs and the whois database to send scheduled e-mails to abuse ISP-s about incidents.
#!/usr/bin/python import sys import os import re import pprint from pyPgSQL import PgSQL from sets import Set import smtplib from email.MIMEText import MIMEText from email.MIMEMultipart import MIMEMultipart _DB=None _DBname="snortdb" _DBuser="snortdb" _DBpass="password" _DBhost="localhost" primaryrecipient="email@add.ress.hu" treshold=5 # minimum no. of events to mail mailhead=""" Hello! This is an automatically generated message from the netpolice robot at MTA SZTAKI Network Security Department. You can reach us at netpolice@sztaki.hu so please DO NOT REPLY to this mail's sending address as your reply will be silently discarded. We are to inform you about several security violations originating from your address space. Please note that our detection system uses an IP packet pattern database so false positives can never be completely eliminated. If you are sure that our warning was pointless please discard this letter, we are sorry for your inconvenience. Your e-mail address has been carefully harvested from the attached whois record. If this message is not for you to concern please tell the responsible person or group to set up an e-mail address beginning with the word 'abuse' and ask your whois administrator to update the record. Our system cannot distinguish between different abuse adresses established for different types of incidents. ---------------------------------------------------------------------- The following activities were detected (you can find more information as the destination port address and other details on the URLs below): %s The activities above were detected from the following source addresses: %s The detailed transcript of the events follows. Note that our system logs the same action from the same source or destination address once per 60 seconds so the actual event rate could be higher. My time zone is CE(S)T (CET with or without daylight saving). See: http://www.timeanddate.com/worldclock/city.html?n=50 ---------------------------------------------------------------------- """ print "snortwarn.py starting ...\n" pp = pprint.PrettyPrinter(indent=4) def int2dquad(int32): a=str((int32 & 0x0ff000000) >> 24) b=str((int32 & 0x000ff0000) >> 16) c=str((int32 & 0x00000ff00) >> 8) d=str((int32 & 0x0000000ff)) return a+"."+b+"."+c+"."+d def db_connect(): global _DB try: _DB = PgSQL.connect(database=_DBname,user=_DBuser,password=_DBpass,host=_DBhost) except PgSQL.Error, msg: print "Connection to database '%s' failed" % dbname print msg, sys.exit() return _DB def db_query(query): global _DB if _DB is None: _DB=db_connect() cur = _DB.cursor() try: cur.execute(query) except PgSQL.Error, msg: print "db_query failed\n%s" % msg, sys.exit() desc={}; i=0 for r in cur.description: desc[i]=r[0] i=i+1 try: cur.arraysize=1000; res = cur.fetchall() except StandardError, msg: print "db_query: fetch of all instanaces failed\n%s" % msg, sys.exit() result={} i=0 for r in res: u=0 result[i]={} for d in desc.values(): result[i][d] = r[u] u=u+1 i=i+1 cur.close() _DB.commit() return result print "fetching alerts from database ..." res=db_query(""" select event.\"timestamp\",signature.sig_name,signature.sig_sid,iphdr.ip_src,iphdr.ip_dst from event,signature,iphdr where iphdr.ip_ttl>0 and iphdr.cid=event.cid and signature.sig_id=event.signature and event.\"timestamp\"> timestamp 'now' - interval '24 hours' and signature in ( select s.sig_id from signature s,sig_class c where s.sig_class_id=c.sig_class_id and c.sig_class_name in ( 'web-application-attack','attempted-admin','misc-attack','denial-of-service','attempted-dos' ) ) """) # order by timestamp print "got " + str(len(res)) + " events ..." # group by ip ips={} for r in res.values(): src=int2dquad(r['ip_src']) if not ips.has_key(src): ips[src]={'count':0, 'alerts': Set(), 'events':{}} ips[src]['count']+=1 ips[src]['events'][r['timestamp']]=r ips[src]['alerts']|=Set([str(r['sig_sid'])+"|"+r['sig_name']]) #pp.pprint(ips) # fetch whois for each ip for r in ips: if ips[r]['count']<3: # drop low noise ips print "dropping "+r+" (bellow alarm treshold)..." ips[r]=None continue print "collecting whois data for "+r+" ..." whois='' whoisp=os.popen("jwhois "+r) whois+=whoisp.read(1024000); whoisp.close(); # whoisp=os.popen("jwhois +"+r) # whois+=whoisp.read(1024000); # whoisp.close(); e=None mailregex="[0-9a-z_.-]*@[0-9a-z_.-]+[.][a-z]+" s=Set() s|=Set(re.compile('(?ims)([0-9a-z_.-]*abuse'+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)abuse.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)incident.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)spam.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)role.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)person.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)route.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)notify.*?('+mailregex+')').findall(whois)) if len(s) == 0: s|=Set(re.compile('(?ims)('+mailregex+')').findall(whois)) if len(s) > 0: e=list(s) # loopback or private ips: no notify if len(re.compile('(?ims)(127[.][0-9]{1,3}[.][0-9]{1,3}[.][0-9]{1,3}|172[.]16[.][0-9]{1,3}[.][0-9]{1,3}|192[.]168[.][0-9]{1,3}[.][0-9]{1,3})').findall(r))>0: print " loopback or private ip " + str(r); # e=[primaryrecipient] e=["mcree@sztaki.hu"] # do not notify ripe or arin technical addresses and our own address if len(re.compile('(?ims)(@ripe.net|@arin.net|@arpnic.net|@nic[.])').findall(str(e)))>0: print " dropping whois technical mail address " + str(e); # e=[primaryrecipient] e=["mcree@sztaki.hu"] # local address if len(re.compile('(?ims)(@sztaki.hu)').findall(str(e)))>0: print " dropping whois technical mail address " + str(e); # e=[primaryrecipient] e=["mcree@sztaki.hu", "btoth@sztaki.hu"] ips[r]['whois']=whois if e is not None: ips[r]['email']=e else: ips[r]['email']=None print " WARNING: no mail address found!" #pp.pprint(ips) # group by emails emails={} for r in ips: if ips[r] is not None: e=ips[r]['email'] if e is not None: if not emails.has_key(str(e)): emails[str(e)]={'count':0, 'alerts':Set(), 'whois':ips[r]['whois'], 'ips':[], 'email':e} emails[str(e)]['ips']+=[r] emails[str(e)]['count']+=ips[r]['count'] emails[str(e)]['alerts']|=ips[r]['alerts'] #pp.pprint(emails) #pp.pprint(ips) for e in emails: if emails[e]['count']>=treshold: print "sending mail to "+e attsum="" for a in emails[e]['alerts']: (sid,desc)=a.split('|') attsum+=desc+"\n" attsum+=" -> http://www.snort.org/snort-db/sid.html?sid="+sid+"\n" ipseach="" ipsuml=[] for i in emails[e]['ips']: ipseach+=i+" ("+str(ips[i]['count'])+" event(s))\n" for a in ips[i]['alerts']: (sid,desc)=a.split('|') ipseach+=" "+desc+"\n" for v in ips[i]['events'].values(): ipsuml+=[str(v['timestamp'])+' '+int2dquad(v['ip_src'])+" -> "+int2dquad(v['ip_dst'])+' '+v['sig_name']+"\n"] ipseach+="" ipsuml.sort() if(len(ipsuml)>100): ipsuml=ipsuml[0:99] ipsum="" ipsum=ipsum.join(ipsuml) ipsum="Transcript follows (limited to 100 records):\n\n"+ipsum+"\n----------------------------------------------------------------------\n\n" #print mailhead % (attsum, ipseach) #print ipsum commaspace=', ' msg=MIMEMultipart() msg['Subject']="Security Notification" msg['From']="devnull@sztaki.hu" msg['To']=commaspace.join([primaryrecipient] + emails[e]['email']) msg.attach(MIMEText((mailhead % (attsum, ipseach)) + ipsum)) # msg.attach(MIMEText(ipsum)) msg.attach(MIMEText("Whois query result follows:\n\n"+emails[e]['whois'])) msg.preamble = 'You should view this message MIME-aware mail reader.\n' msg.epilogue = '' s = smtplib.SMTP() s.connect() for recip in ([primaryrecipient] + emails[e]['email']): # print "sending mail to " + str(recip) s.sendmail("devnull@sztaki.hu", recip, msg.as_string()) s.close() #print msg.as_string()