зеркало из https://github.com/mozilla/MozDef.git
112 строки
4.9 KiB
Python
112 строки
4.9 KiB
Python
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
# Copyright (c) 2014 Mozilla Corporation
|
|
#
|
|
# Contributors:
|
|
# Jeff Bryner jbryner@mozilla.com
|
|
|
|
import netaddr
|
|
|
|
|
|
def isIP(ip):
|
|
try:
|
|
netaddr.IPNetwork(ip)
|
|
return True
|
|
except:
|
|
return False
|
|
|
|
|
|
class message(object):
|
|
def __init__(self):
|
|
'''register our criteria for being passed a message
|
|
as a list of lower case strings or values to match with an event's dictionary of keys or values
|
|
set the priority if you have a preference for order of plugins to run. 0 goes first, 100 is assumed/default if not sent
|
|
'''
|
|
# get specific categories
|
|
# for firefox accounts data sent by heka
|
|
self.registration = ['fxaauthwebserver',
|
|
'fxaauth',
|
|
'fxacontentwebserver',
|
|
'fxacustoms',
|
|
'fxaoauthwebserver',
|
|
'fxabrowseridwebserver',
|
|
'fxaprofilewebserver',
|
|
'fxa-auth-server'
|
|
]
|
|
self.priority = 10
|
|
|
|
def onMessage(self, message, metadata):
|
|
#drop non-relevant messages
|
|
if message['eventsource'] in ('FxaContentWebserver', 'FxaAuthWebserver', 'FxaOauthWebserver', 'FxaAuth', 'fxa-auth-server'):
|
|
if 'details' in message.keys():
|
|
if 'status' in message['details']:
|
|
if message['details']['status'] == 200:
|
|
#normal 200 returns for web content
|
|
return(None, metadata)
|
|
# FxaAuth sends http status as 'code'
|
|
if 'code' in message['details']:
|
|
if message['details']['code'] == 200:
|
|
#normal 200 returns for web content
|
|
return(None, metadata)
|
|
if 'op' in message['details']:
|
|
if message['details']['op'] == 'mailer.send.1':
|
|
# Due to status flag not being a string
|
|
return(None, metadata)
|
|
|
|
# tag the message
|
|
if 'tags' in message.keys() and isinstance(message['tags'], list):
|
|
message['tags'].append('firefoxaccounts')
|
|
else:
|
|
message['tags'] = ['firefoxaccounts']
|
|
|
|
# fix various fields
|
|
if 'details' in message.keys() and isinstance(message['details'], dict):
|
|
# elastic search needs valid IPs for ip fields.
|
|
if 'http_x_forwarded_for' in message['details'].keys():
|
|
if message['details']['http_x_forwarded_for'] == '-':
|
|
message['details']['http_x_forwarded_for'] = '0.0.0.0'
|
|
|
|
if 'upstream_response_time' in message['details'].keys():
|
|
if message['details']['upstream_response_time'] == '-':
|
|
message['details']['upstream_response_time'] = 0
|
|
|
|
# category fixes
|
|
if 'name' in message['details'].keys():
|
|
if message['details']['name'] == 'fxa-auth-server':
|
|
message['category'] = 'fxa-auth-server'
|
|
|
|
if message['eventsource'] in ('FxaContentWebserver', 'FxaAuthWebserver'):
|
|
if message['category'] == 'logfile':
|
|
message['category'] = 'weblog'
|
|
|
|
|
|
if 'remoteAddressChain' in message['details'].keys():
|
|
if isinstance(message['details']['remoteAddressChain'], list):
|
|
sourceIP = message['details']['remoteAddressChain'][0]
|
|
if isIP(sourceIP):
|
|
message['details']['sourceipaddress'] = sourceIP
|
|
|
|
# handle the case of an escaped list:
|
|
# "remoteAddressChain": "[\"52.25.186.142\",\"172.31.8.233\",\"127.0.0.1\"]"
|
|
if ( isinstance(message['details']['remoteAddressChain'], unicode) and
|
|
message['details']['remoteAddressChain'][0]=='[' and
|
|
message['details']['remoteAddressChain'][-1]==']' ):
|
|
# remove the brackets and double quotes
|
|
for i in ['[',']','"']:
|
|
message['details']['remoteAddressChain']=message['details']['remoteAddressChain'].replace(i,'')
|
|
# make sure it's still a list
|
|
if ',' in message['details']['remoteAddressChain']:
|
|
sourceIP = message['details']['remoteAddressChain'].split(',')[0]
|
|
if isIP(sourceIP):
|
|
message['details']['sourceipaddress'] = sourceIP
|
|
|
|
|
|
#fxacustoms sends source ip as just 'ip'
|
|
if 'ip' in message['details'].keys():
|
|
if isIP(message['details']['ip']):
|
|
message['details']['sourceipaddress'] = message['details']['ip']
|
|
|
|
|
|
return (message, metadata)
|