ipvar HOME_NET any 

output unified2: filename snort.log, limit 128

preprocessor stream5_global: track_tcp yes, \
   track_udp yes, \
   track_icmp no, \
   max_tcp 262144, \
   memcap 1073741824, \
   max_udp 131072, \
   max_active_responses 2, \
   min_response_seconds 5

#config logdir:/var/log/barnyard2 
#config hostname: localhost
#config interface: eth0
#config waldo_file:/var/log/snort/barnyard2.waldo
#config dump_payload
#config dump_payload_verbose
#output database: log,mysql,user=user password=xxxxx dbname=snort host=x.x.x.x

barnyard2 -c /etc/snort/barnyard.conf -T

dumpcap -i eth0 -B 1024 -b duration:60 -b files:1000 -w /pcap/test.pcap

	# pcaplist_total 表示目录下所有的pcap文件，以集合的方式表示
        pcaplist_total = list(set(pcaplist_total) - set(opening_files))
        # pcaplist_tohandle  表示未分析的pcap文件  
        pcaplist_tohandle = list(set(pcaplist_total) - set(pcaplist_handled))

        # 当未处理的pcap文件数小于三个，继续等待，可以根据情况自己设置
        if len(pcaplist_tohandle) < 3:
            logging.info("Waiting for more pcap files for {} times...".format(cycletime))
            sleeptime = 10*cycletime
            if sleeptime > 600:
                sleep(600)
            else:
                sleep(sleeptime)
            cycletime +=1
            continue

        cycletime=1
        snort_option = snort_command + '"{}"'.format(" ".join(pcaplist_tohandle))

        logging.info("Snort is starting to analyze {} pcap files...".format(len(pcaplist_tohandle)))

        # 有几个pcap文件就分成几份，最多分成8份，最多启动8个进程
        pcaplist_tohandle_chunked = chunks(pcaplist_tohandle,8)

        start_time = timeit.default_timer()
        pool = threadpool.ThreadPool(8) # most 8 processes 

        # 通过snort -c /etc/snort/snort.conf -q -l /var/log/snort --pcap-list 来调用snort  
        reqs = threadpool.makeRequests(call_snort, pcaplist_tohandle_chunked)
        [pool.putRequest(req) for req in reqs]
        pool.wait()

barnyard2 -c /etc/snort/barnyard.conf -d /var/log/snort -f snort.log -l /var/log/barnyard2/ -D

#!/bin/sh
ps -ef |grep barnyard2|grep -v grep
if [ $? -ne 0 ]
then
barnyard2 -c /etc/snort/barnyard.conf -d /var/log/snort -f snort.log -l /var/log/barnyard2/ -D
echo `date` "Start bardyard2" >> /var/log/barnyard2/barnyard.log
fi

ReportMailer.daily_report.deliver, ReportMailer.weekly_report.deliver, ReportMailer.monthly_report.deliver

if [ "$#" -ne 1 ]; then exit 1; fi
job=$1
cd /home/Green-m/snorby-master
RAILS_ENV=production bundle exec rails r ReportMailer.${job}_report.deliver

10 10 * * * /home/Green-m/snorby-report.sh daily
15 10 * * 1 /home/Green-m/snorby-report.sh weekly
20 10 1 * * /home/Green-m/snorby-report.sh monthly

SQL (37692.992ms)  select count(*) from aggregated_events;
SQL (67081.531ms)
 select e.sid, e.cid, e.signature,
 e.classification_id, e.users_count,
 e.notes_count, e.timestamp, e.user_id,
 a.number_of_events from aggregated_events a
 inner join event e on a.event_id = e.id
 order by e.timestamp desc limit 45 offset 0

select `iphdr`.`ip_src` AS `ip_src`,`iphdr`.`ip_dst` AS `ip_dst`,`event`.`signature` AS `signature`,max(`event`.`id`) AS `event_id`,count(0) AS `number_of_events` from (`event` join `iphdr` on(((`event`.`sid` = `iphdr`.`sid`) and (`event`.`cid` = `iphdr`.`cid`)))) where isnull(`event`.`classification_id`) group by `iphdr`.`ip_src`,`iphdr`.`ip_dst`,`event`.`signature` limit 10;

select `iphdr`.`ip_src` AS `ip_src`,`iphdr`.`ip_dst` AS `ip_dst`,`event`.`signature` AS `signature`,max(`event`.`id`) AS `event_id`,count(0) AS `number_of_events` from (`event` join `iphdr` on(((`event`.`sid` = `iphdr`.`sid`) and (`event`.`cid` = `iphdr`.`cid`)))) where isnull(`event`.`classification_id`) and `event`.`timestamp` >= NOW() - INTERVAL 7 DAY  group by `iphdr`.`ip_src`,`iphdr`.`ip_dst`,`event`.`signature` limit 10;

config bpf_file: /etc/snort/ignore.bpf

not (host 192.168.1.105 or host 192.168.1.106 or host 192.168.1.107)

not net 192.168.1.0/24

def snort_query(sid_list):
    query_result = []
    connection = pymysql.connect(host='xxxx',
                             user='snorby',
                             password='xxxxx',
                             db='snorby',
                             charset='utf8mb4',
                             cursorclass=pymysql.cursors.DictCursor)

    try:
        with connection.cursor() as cursor:

            for sid in sid_list:
                sql = """
                        select `signature`.sig_name AS `signature`, inet_ntoa(`iphdr`.`ip_src`) AS `ip_src`, inet_ntoa(`iphdr`.`ip_dst`) AS `ip_dst`, `event`.`timestamp` AS `timestamp`, count(0) AS `number_of_events`, `signature`.`sig_sid` AS `SID` ,
                        (SELECT name from asset_names WHERE asset_names.ip_address = `iphdr`.`ip_src`) AS `IP_SRC_INFO`,
                        (SELECT name from asset_names WHERE asset_names.ip_address = `iphdr`.`ip_dst`) AS `IP_DST_INFO` 
                        from ((`event` join `signature` on (`event`.`signature` = `signature`.`sig_id`)) join `iphdr` on (((`event`.`sid` = `iphdr`.`sid`) and (`event`.`cid` = `iphdr`.`cid`))) ) 
                        where isnull(`event`.`classification_id`) and `signature`.`sig_sid`={} and `event`.`timestamp` >= NOW() - INTERVAL 5 MINUTE  group by `iphdr`.`ip_src`,`iphdr`.`ip_dst`,`event`.`signature`;
                        """.format(sid)

                cursor.execute(sql)
                results = cursor.fetchall()
                if results:
                    query_result.append(results)
                    


    finally:
        connection.close()

    return query_result

if __name__ == '__main__':


    sid_list = [12345,678910] # SID
    query_result = snort_query(sid_list)
    if query_result :
        mailbody = info_to_mailbody(query_result)
        send_email(mailbody,"Greenm@xxx.com")
        logging.info("Sended email")