From bfff06b296db0bc5b300646c23e17f55e4ebe3cf Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Mon, 25 Feb 2019 10:43:33 +0100 Subject: [PATCH] ETPro-Telemetry, remove sensitive/irrelevant data from output --- .../etpro_telemetry/telemetry/__init__.py | 26 ++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/security/etpro-telemetry/src/opnsense/scripts/etpro_telemetry/telemetry/__init__.py b/security/etpro-telemetry/src/opnsense/scripts/etpro_telemetry/telemetry/__init__.py index 26ac31584..8b3b39646 100755 --- a/security/etpro-telemetry/src/opnsense/scripts/etpro_telemetry/telemetry/__init__.py +++ b/security/etpro-telemetry/src/opnsense/scripts/etpro_telemetry/telemetry/__init__.py @@ -37,7 +37,15 @@ import ujson BASE_URL = 'https://opnsense.emergingthreats.net' RELATED_SIDS_FILE = '/usr/local/etc/suricata/rules/telemetry_sids.txt' - +UNFILTERED_OUTPUT_FIELDS = [ + 'timestamp', 'flow_id', 'in_iface', 'event_type', 'vlan', + 'src_port', 'dest_port', 'proto', 'alert', 'tls', 'http', 'app_proto' +] +# remove from output, either sensitive or irrelevant +CLEANUP_OUTPUT_FIELDS = [ + 'alert.category', 'alert.severity', 'alert.gid', 'alert.signature', 'alert.metadata', + 'http.http_user_agent', 'http.url', 'http.redirect' +] def get_config(rule_update_config): """ @@ -142,11 +150,23 @@ class EventCollector(object): to_push[address] = record[address] # unfiltered output fields - for attr in ["timestamp", "flow_id", "in_iface", "event_type", - "vlan", "src_port", "dest_port", "proto", "alert", "tls", "http", "app_proto"]: + for attr in UNFILTERED_OUTPUT_FIELDS: if attr in record: to_push[attr] = record[attr] + # exclude partial fields + for attr in CLEANUP_OUTPUT_FIELDS: + to_push_ref = to_push + attr_parts = attr.split('.') + for item in attr_parts[:-1]: + if item in to_push_ref: + to_push_ref = to_push_ref[item] + else: + to_push_ref = None + continue + if to_push_ref and attr_parts[-1] in to_push_ref: + del to_push_ref[attr_parts[-1]] + self._tmp_handle.write(("%s\n" % ujson.dumps(to_push)).encode()) def get(self):