Introduce message parser for snort alerts.
[people/stevee/guardian.git] / modules / Parser.pm
CommitLineData
88d9af2c
SS
1package Guardian::Parser;
2use strict;
3use warnings;
4
5use Exporter qw(import);
6
cfe5a220 7our @EXPORT_OK = qw(IsSupportedParser Parser);
88d9af2c 8
cfe5a220
SS
9# This hash contains all supported parsers and which function
10# has to be called to parse messages in the right way.
88d9af2c 11my %logfile_parsers = (
cfe5a220 12 "snort" => \&message_parser_snort,
88d9af2c
SS
13);
14
15#
16## The main parsing function.
17#
18## It is used to determine which sub-parser has to be used to
19## parse the given message in the right way and to return if
20## any action should be performed.
21#
22sub Parser ($$) {
cfe5a220 23 my ($parser, @message) = @_;
88d9af2c
SS
24
25 # If no responsible message parser could be found, just return nothing.
cfe5a220 26 unless (exists($logfile_parsers{$parser})) {
88d9af2c
SS
27 return;
28 }
29
cfe5a220
SS
30 # Call responsible message parser.
31 my $action = $logfile_parsers{$parser}->(@message);
88d9af2c 32
dd048373
SS
33 # If the parser successfully parsed the message, an action
34 # has been returned.
35 if ($action) {
36 # Return which action should be performed.
37 return "count $action";
38 }
39
40 # If the parser was not able to parse the the given message
41 # in the right way, return Nothing.
42 return;
88d9af2c
SS
43}
44
cfe5a220
SS
45#
46## IsSupportedParser function.
47#
48## This very tiny function checks if a given parser name is available and
49## therefore a supported parser.
50#
51## To perform these check, the function is going to lookup if a key in the
52## hash of supported parsers is available
53#
54sub IsSupportedParser ($) {
55 my $parser = $_[0];
56
57 # Check if a key for the given parser exists in the hash of logfile_parsers.
58 if(exists($logfile_parsers{$parser})) {
59 # Found a valid parser, so return nothing.
60 return 1;
61 }
62
63 # Return "False" if we got here, and therefore no parser
64 # is available.
65 return;
66}
67
88d9af2c
SS
68#
69## The Snort message parser.
70#
71## This subfunction is responsible for parsing sort alerts and determine if
72## an action should be performed.
73#
53a02397
SS
74## XXX Currently the parser only supports IPv4. Add support for IPv6 at a
75## later time.
76#
77sub message_parser_snort(@) {
88d9af2c
SS
78 my @message = @_;
79
53a02397
SS
80 # The name of the parser module.
81 my $name = "SNORT";
82
83 # Variable to store the grabbed IP-address.
84 my $address;
85
86 # Default returned message in case no one could be grabbed
87 # from the snort alert.
88 my $message = "An active snort rule has matched and gained an alert.";
89
90 # A snort alert contains multiple lines, loop through all lines
91 # to parse the complete alert.
92 foreach my $line (@message) {
93 # Check Priority Level and skip the alert if it is to low.
94 #if ($line =~ /.*\[Priority: (\d+)\].*/) {
95 # return unless($1 < $priority);
96 #}
97
98 # Search for a line like xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx
99 if ($line =~ /(\d+\.\d+\.\d+\.\d+)+ -\> (\d+\.\d+\.\d+\.\d+)+/) {
100 # Store the grabbed IP-address.
101 $address = $1;
102 }
103
104 # Search for a line like xxx.xxx.xxx.xxx:xxx -> xxx.xxx.xxx.xxx:xxx
105 elsif ($line =~ /(\d+\.\d+\.\d+\.\d+):\d+ -\> (\d+\.\d+\.\d+\.\d+):\d+/) {
106 # Store the obtained IP-address.
107 $address = $1;
108 }
109
110 # Obtain the reported reason.
111 if ($line =~ /.*msg:\"(.*)\".*/) {
112 # Store the extracted message.
113 $message = $1;
114 }
115 }
116
117 # Check if at least the IP-address information are obtained from the
118 # provided alert.
119 if ($address) {
120 # Return the extracted values.
121 return "$address $name $message";
122 }
123
124 # If we got here, the alert could not be parsed correctly, return nothing.
125 return;
88d9af2c
SS
126}
127
1281;