## This subfunction is responsible for parsing sort alerts and determine if
## an action should be performed.
#
-sub message_parser_snort($) {
+## XXX Currently the parser only supports IPv4. Add support for IPv6 at a
+## later time.
+#
+sub message_parser_snort(@) {
my @message = @_;
- # XXX
- # Currently this parser just returns a simple message.
- return "$message[0] SNORT A simple Snort Message";
+ # The name of the parser module.
+ my $name = "SNORT";
+
+ # Variable to store the grabbed IP-address.
+ my $address;
+
+ # Default returned message in case no one could be grabbed
+ # from the snort alert.
+ my $message = "An active snort rule has matched and gained an alert.";
+
+ # A snort alert contains multiple lines, loop through all lines
+ # to parse the complete alert.
+ foreach my $line (@message) {
+ # Check Priority Level and skip the alert if it is to low.
+ #if ($line =~ /.*\[Priority: (\d+)\].*/) {
+ # return unless($1 < $priority);
+ #}
+
+ # Search for a line like xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx
+ if ($line =~ /(\d+\.\d+\.\d+\.\d+)+ -\> (\d+\.\d+\.\d+\.\d+)+/) {
+ # Store the grabbed IP-address.
+ $address = $1;
+ }
+
+ # Search for a line like xxx.xxx.xxx.xxx:xxx -> xxx.xxx.xxx.xxx:xxx
+ elsif ($line =~ /(\d+\.\d+\.\d+\.\d+):\d+ -\> (\d+\.\d+\.\d+\.\d+):\d+/) {
+ # Store the obtained IP-address.
+ $address = $1;
+ }
+
+ # Obtain the reported reason.
+ if ($line =~ /.*msg:\"(.*)\".*/) {
+ # Store the extracted message.
+ $message = $1;
+ }
+ }
+
+ # Check if at least the IP-address information are obtained from the
+ # provided alert.
+ if ($address) {
+ # Return the extracted values.
+ return "$address $name $message";
+ }
+
+ # If we got here, the alert could not be parsed correctly, return nothing.
+ return;
}
#