-
Notifications
You must be signed in to change notification settings - Fork 49
/
artlas.py
207 lines (168 loc) · 6.85 KB
/
artlas.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
import syslog_client as syslog
import re
import requests
import json
import telepot
from time import sleep
import apache_log_parser
from pygtail import Pygtail
from threading import Thread
from pyzabbix import ZabbixMetric, ZabbixSender
from ConfigParser import ConfigParser
class ARTLAS(object):
def __init__(self, config_file):
print('[*] Getting config...')
self.conf = dict()
self.get_conf(config_file)
print('[+] Done!\n')
# Check if CEF_Syslog is enabled
if self.conf['cef_syslog_enable']:
print '[+] Syslog Enabled'
self.syslog = syslog.Syslog(self.conf['cef_syslog_server'])
# Check if Telegram is enabled
if self.conf['telegram_enable']:
print '[+] Telegram Enabled'
self.bot = telepot.Bot(self.conf['api'])
# Check if Slack is enabled
if self.conf['slack_enable']:
print '[+] Slack Enabled'
# Check if Zabbix is enabled
if self.conf['zabbix_enable']:
print '[+] Zabbix Enabled'
print 'Notifications ',self.conf['notifications']
print 'Advanced ',self.conf['zabbix_advantage_keys']
print
print('[*] Getting rules...')
self.get_file_rules()
print('[+] Done!\n')
self.rules = json.loads(open(self.conf['rules']).read())
self.white_rules = open(self.conf['whitelist']).read().strip().split(',')
# List of all senders, enabled or not
self.senders = [self.send_zabbix, self.send_cef_syslog,self.send_telegram, self.send_slack]
print('[*] A.R.T.L.A.S Started!\n')
def get_conf(self, config_file):
config = ConfigParser()
config.read(config_file)
# Telegram
self.conf['api'] = config.get('Telegram','api')
self.conf['group_id'] = int(config.get('Telegram','group_id'))
# One should use getboolean to fetch boolean values, otherwise they will always be True unless empty
self.conf['telegram_enable'] = config.getboolean('Telegram','enable')
# Slack
self.conf['link_webhook'] = config.get('Slack', 'link_webhook')
self.conf['slack_enable'] = config.getboolean('Slack', 'enable')
# Zabbix
self.conf['server_name'] = config.get('Zabbix','server_name')
self.conf['agentd_config'] = config.get('Zabbix','agentd_config')
self.conf['zabbix_advantage_keys'] = config.getboolean('Zabbix','enable_advantage_keys')
self.conf['notifications'] = config.getboolean('Zabbix','notifications')
self.conf['zabbix_enable'] = config.getboolean('Zabbix','enable')
# Apache
self.conf['apache_log'] = config.get('General', 'apache_log')
self.conf['rules'] = config.get('General', 'rules')
self.conf['whitelist'] = config.get('General', 'whitelist')
self.conf['apache_mask'] = config.get('General', 'apache_mask')
self.conf['vhost_enable'] = config.getboolean('General', 'vhost_enable')
# CEF_Syslog
self.conf['cef_syslog_enable'] = config.getboolean('CEF_Syslog','enable')
self.conf['cef_syslog_server'] = config.get('CEF_Syslog','server_name')
return self.conf
def get_file_rules(self):
r = requests.get('https://raw.githubusercontent.com/PHPIDS/PHPIDS/master/lib/IDS/default_filter.json')
with open('etc/default_filter.json','w') as file_rules:
file_rules.write(r.content)
file_rules.close()
def owasp(self, path):
for filtro in self.rules['filters']['filter']:
if filtro['id'] in self.white_rules:
continue
try:
if re.search(filtro['rule'], path):
return filtro
except:
continue
def send_zabbix(self, log):
if self.conf['zabbix_enable']:
msg = self.verbose_format(log)
impact = int(log['owasp']['impact'])
allowed_range = range(1,8)
if self.conf['zabbix_advantage_keys']:
metrics = [ZabbixMetric(self.conf['server_name'], 'artlas_check{}'.format('_0{}'.format(impact) if impact in allowed_range else ''), msg)]
else:
metrics = [ZabbixMetric(self.conf['server_name'], 'artlas_check',msg)]
ZabbixSender(use_config=self.conf['agentd_config']).send(metrics)
if self.conf['notifications']:
if self.conf['zabbix_advantage_keys']:
metrics = [ZabbixMetric(self.conf['server_name'], 'artlas_check{}'.format('_0{}'.format(impact) if impact in allowed_range else ''), "OK")]
else:
metrics = [ZabbixMetric(self.conf['server_name'], 'artlas_check',"OK")]
ZabbixSender(use_config=self.conf['agentd_config']).send(metrics)
def send_cef_syslog(self, log):
if self.conf['cef_syslog_enable']:
msg = self.cef_format(log)
self.syslog.warn(msg)
def send_telegram(self, log):
if self.conf['telegram_enable']:
msg = self.verbose_format(log)
sleep(3)
self.bot.sendMessage(self.conf['group_id'], msg)
def send_slack(self, log):
if self.conf['slack_enable']:
msg = self.verbose_format(log)
sleep(3)
requests.post(self.conf['link_webhook'], headers={'Content-type': 'application/json'}, data='{{"text":"```{}```"}}'.format(msg))
def send_all(self, log):
print(self.verbose_format(log))
for sender in self.senders:
sender(log)
def verbose_format(self, log):
msg ='''[+] - Intrusion Attempt - [+]
Date: {cef_date}
Vhost: {vhost}
IP: {remote_host}
Path: {request_url}
User-Agent: {request_header_user_agent}
Browser: {request_header_user_agent__browser__family} {request_header_user_agent__browser__version_string}
S.O: {request_header_user_agent__os__family}
Description: {owasp_description}
Status Code: {status}
Rule ID: {rule_id}
Impact: {owasp_impact}
Category: {owasp_category}'''.format(rule_id=log['owasp']['id'], owasp_description=log['owasp']['description'], owasp_impact=log['owasp']['impact'], owasp_category=','.join(log['owasp']['tags']['tag']), **log)
return msg
def cef_format(self, log):
msg = 'CEF:0|ARTLAS|ARTLAS|1.0|INTRUSION_ATTEMPT|Intrusion Attempt|{owasp_impact}|end={cef_date} cs1={vhost} cs1Label=Vhost src={remote_host}\
request={request_url} requestClientApplication="{request_header_user_agent__browser__family} {request_header_user_agent__os__family} {request_header_user_agent__browser__version_string}"\
message={owasp_description} cs2={owasp_category} cs2Label=Category'.format(owasp_description=log['owasp']['description'], owasp_impact=log['owasp']['impact'], owasp_category=','.join(log['owasp']['tags']['tag']), **log)
return msg
def connections(self, linha):
try:
line_parser = apache_log_parser.make_parser(self.conf['apache_mask'])
log = line_parser(linha)
if self.conf['vhost_enable']:
log['vhost'] = linha.split(' ')[0]
else:
log['vhost'] = None
log['owasp'] = self.owasp(log['request_url'])
if log['owasp']:
log['cef_date'] = log['time_received_datetimeobj'].strftime('%b %d %Y %H:%M:%S')
self.send_all(log)
except:
pass
def run(self):
while True:
try:
for linha in Pygtail(self.conf['apache_log']):
t = Thread(target=self.connections, args=(linha,))
t.start()
# Prevent processing overflow
except IOError:
print('[-] Log not found: {}, waiting...'.format(self.conf['apache_log']))
sleep(5)
except:
pass
finally:
sleep(0.01)
if __name__ == '__main__':
artlas = ARTLAS('etc/artlas.conf')
artlas.run()