Ревизия фрагмента gistfile1.txt

nuno ревизий этого фрагмента 1 month ago. К ревизии

1 file changed, 135 insertions

gistfile1.txt(файл создан)

		@@ -0,0 +1,135 @@
1	+	def fw_events(file, filter_ip, filter_type, clients_dir, limit):
2	+	"""Format firewall drop events with dedup and counts"""
3	+	import glob
4	+	proto_map = {1: 'icmp', 6: 'tcp', 17: 'udp'}
5	+
6	+	ip_to_name = {}
7	+	for conf in glob.glob(f"{clients_dir}/*.conf"):
8	+	name = os.path.basename(conf).replace('.conf', '')
9	+	try:
10	+	with open(conf) as f:
11	+	for line in f:
12	+	if line.startswith('Address'):
13	+	ip = line.split('=')[1].strip().split('/')[0]
14	+	ip_to_name[ip] = name
15	+	except:
16	+	pass
17	+
18	+	events = []
19	+	last_seen = {}
20	+
21	+	try:
22	+	with open(file) as f:
23	+	for line in f:
24	+	try:
25	+	e = json.loads(line.strip())
26	+	src = e.get('src_ip', '')
27	+	if not src:
28	+	continue
29	+	if filter_ip and src != filter_ip:
30	+	continue
31	+	dst = e.get('dest_ip', '')
32	+	port = e.get('dest_port', '')
33	+	proto = e.get('ip.protocol', 0)
34	+	key = (src, dst, port, proto)
35	+	ts_str = e.get('timestamp', '')
36	+	try:
37	+	from datetime import datetime
38	+	ts = datetime.fromisoformat(ts_str).timestamp()
39	+	except:
40	+	ts = 0
41	+	windows = {1: 5, 6: 30, 17: 10}
42	+	window = windows.get(proto, 10)
43	+	if key in last_seen and (ts - last_seen[key]) < window:
44	+	continue
45	+	last_seen[key] = ts
46	+	events.append(e)
47	+	except:
48	+	pass
49	+	except:
50	+	pass
51	+
52	+	# Dedup consecutive same src+dst+port within 60s with count
53	+	deduped = []
54	+	counts = []
55	+	for e in events:
56	+	ts_str = e.get('timestamp', '')
57	+	try:
58	+	from datetime import datetime
59	+	ts = datetime.fromisoformat(ts_str).timestamp()
60	+	except:
61	+	ts = 0
62	+	src = e.get('src_ip', '')
63	+	dst = e.get('dest_ip', '')
64	+	port = e.get('dest_port', '')
65	+	proto = e.get('ip.protocol', 0)
66	+	key = (src, dst, port, proto)
67	+
68	+	if deduped and counts:
69	+	prev = deduped[-1]
70	+	try:
71	+	prev_ts = datetime.fromisoformat(prev.get('timestamp','')).timestamp()
72	+	except:
73	+	prev_ts = 0
74	+	prev_key = (prev.get('src_ip',''), prev.get('dest_ip',''),
75	+	prev.get('dest_port',''), prev.get('ip.protocol',0))
76	+	if key == prev_key and (ts - prev_ts) < 60:
77	+	counts[-1] += 1
78	+	continue
79	+
80	+	deduped.append(e)
81	+	counts.append(1)
82	+
83	+	grouped = []
84	+	group_counts = []
85	+	for e in deduped:
86	+	ts_str = e.get('timestamp', '')
87	+	try:
88	+	from datetime import datetime
89	+	dt = datetime.fromisoformat(ts_str)
90	+	# Truncate to minute for grouping
91	+	minute_key = dt.strftime('%Y-%m-%d %H:%M')
92	+	except:
93	+	minute_key = ts_str[:16]
94	+
95	+	src = e.get('src_ip', '')
96	+	dst = e.get('dest_ip', '')
97	+	port = e.get('dest_port', '')
98	+	proto = e.get('ip.protocol', 0)
99	+	key = (minute_key, src, dst, proto) # group within same minute
100	+
101	+	if grouped and group_counts:
102	+	prev = grouped[-1]
103	+	try:
104	+	prev_dt = datetime.fromisoformat(prev.get('timestamp',''))
105	+	prev_minute = prev_dt.strftime('%Y-%m-%d %H:%M')
106	+	except:
107	+	prev_minute = ''
108	+	prev_key = (prev_minute, prev.get('src_ip',''),
109	+	prev.get('dest_ip',''), prev.get('ip.protocol',0))
110	+	if key == prev_key:
111	+	group_counts[-1] += 1
112	+	continue
113	+
114	+	grouped.append(e)
115	+	group_counts.append(1)
116	+
117	+	for e, count in zip(deduped[-int(limit):], counts[-int(limit):]):
118	+	ts = e.get('timestamp', '')
119	+	try:
120	+	from datetime import datetime
121	+	dt = datetime.fromisoformat(ts)
122	+	ts = dt.strftime(DATETIME_FMT)
123	+	except:
124	+	pass
125	+	src = e.get('src_ip', '—')
126	+	dst = e.get('dest_ip', '—')
127	+	port = e.get('dest_port', '')
128	+	proto_num = e.get('ip.protocol', 0)
129	+	proto = proto_map.get(proto_num, str(proto_num))
130	+	dst_str = f"{dst}:{port}" if port else dst
131	+	client = ip_to_name.get(src, src)
132	+	if filter_type and not client.startswith(filter_type + '-'):
133	+	continue
134	+	count_str = f" (x{count})" if count > 1 else ""
135	+	print(f"{ts}\|{client}\|{dst_str}\|{proto}{count_str}")

Новее Позже