netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

etpro-telemetry, keep documentation and test data with product for development/internal use

Browse Source
This commit is contained in:
Ad Schellevis
2019-04-02 16:40:39 +02:00
parent 6b610ae90b
commit edb29455b3
4 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security/etpro-telemetry/README.md
+95
View File
@@ -0,0 +1,95 @@
# ETPRO telemetry edition
Telemetry tools, depends on `rule-updater.config`, which contains the device registartion number provided by OPNsense.
for example.
```
# autogenerated, do not edit.
[__properties__]
et_telemetry.token=eeyahsei1nootu6aeJ5Eeghoohahxu4rahkiewu2bayeiv2eif
```
The scripts will be scheduled automatically using a cron job after installation of the ruleset / telemetry function.
General
----------------
All scripts described in the readme are available in the directory `src/opnsense/scripts/etpro_telemetry`
Requirements
--------------
Install requirements (default available on OPNsense)
```
pip install -r requires.txt
```
send_telemetry.py
-----------------
Send anonymized telemetry data from Suricata eve log file, for details how the anonimisation works see `EventCollector._get_local_networks()` and
`EventCollector.push()' where all local attached networks are used to strip off the first segments of the address before sending.
```
usage: send_telemetry.py [-h] [-e ENDPOINT] [-i] [-c CONFIG] [-l LOG]
[-s STATE]
optional arguments:
-h, --help show this help message and exit
-e ENDPOINT, --endpoint ENDPOINT
Endpoint url to reach
-i, --insecure Insecure, skip certificate validation
-c CONFIG, --config CONFIG
rule downloader configuration
-l LOG, --log LOG log directory containing eve.json files
-s STATE, --state STATE
persistent state (and lock) filename
-d DAYS, --days DAYS Maximum number of days to look back on initial run
```
to test using supplied configuration:
```
python send_telemetry.py -i -d 9999 -e https://endpoint -c testdata/rule-updater.config -l testdata/log/
```
State is saved `/usr/local/var/run/et_telemetry.state` by default.
send_heartbeat.py
------------------
Send a small heartbeat to proofpoint to signal the device is still active.
```
usage: send_heartbeat.py [-h] [-e ENDPOINT] [-i] [-c CONFIG]
optional arguments:
-h, --help show this help message and exit
-e ENDPOINT, --endpoint ENDPOINT
Endpoint url to reach
-i, --insecure Insecure, skip certificate validation
-c CONFIG, --config CONFIG
rule downloader configuration
```
send_heartbeat.py
------------------
Dump suricata eve.log
```
usage: dump_data.py [-h] [-l LOG] [-t TIME] [-p] [-L LIMIT]
optional arguments:
-h, --help show this help message and exit
-l LOG, --log LOG log directory containing eve.json files
-t TIME, --time TIME max seconds to read from now()
-p, --parsed show data as shipped using send_telemetry
-L LIMIT, --limit LIMIT
limit number of rows
```
security/etpro-telemetry/requires.txt
+2
View File
@@ -0,0 +1,2 @@
requests
ujson
security/etpro-telemetry/testdata/log/eve.json
Vendored Executable
+6
View File
@@ -0,0 +1,6 @@
{"timestamp":"2018-05-21T13:05:42.646499+0200","flow_id":1612621304749411,"in_iface":"em1","event_type":"alert","src_ip":"fe80:0000:0000:0000:021c:42ff:fec0:d65f","dest_ip":"ff02:0000:0000:0000:0000:0000:0000:0016","proto":"IPV6-ICMP","icmp_type":143,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":2200094,"rev":2,"signature":"SURICATA zero length padN option","category":"Generic Protocol Command Decode","severity":3}}
{"timestamp":"2018-05-21T13:05:43.252983+0200","flow_id":1612621304749411,"in_iface":"em1","event_type":"alert","src_ip":"fe80:0000:0000:0000:021c:42ff:fec0:d65f","dest_ip":"ff02:0000:0000:0000:0000:0000:0000:0016","proto":"IPV6-ICMP","icmp_type":143,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":2200094,"rev":2,"signature":"SURICATA zero length padN option","category":"Generic Protocol Command Decode","severity":3}}
{"timestamp":"2018-05-21T13:05:48.646577+0200","flow_id":130587005083057,"in_iface":"em1","event_type":"alert","src_ip":"fe80:0000:0000:0000:021c:42ff:fe0d:9ba1","dest_ip":"ff02:0000:0000:0000:0000:0000:0000:0016","proto":"IPV6-ICMP","icmp_type":143,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":2200094,"rev":2,"signature":"SURICATA zero length padN option","category":"Generic Protocol Command Decode","severity":3}}
{"timestamp":"2018-05-21T13:05:48.846691+0200","flow_id":130587005083057,"in_iface":"em1","event_type":"alert","src_ip":"fe80:0000:0000:0000:021c:42ff:fe0d:9ba1","dest_ip":"ff02:0000:0000:0000:0000:0000:0000:0016","proto":"IPV6-ICMP","icmp_type":143,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":2200094,"rev":2,"signature":"SURICATA zero length padN option","category":"Generic Protocol Command Decode","severity":3}}
{"timestamp":"2018-05-21T13:05:49.846589+0200","flow_id":130587005083057,"in_iface":"em1","event_type":"alert","src_ip":"fe80:0000:0000:0000:021c:42ff:fe0d:9ba1","dest_ip":"ff02:0000:0000:0000:0000:0000:0000:0016","proto":"IPV6-ICMP","icmp_type":143,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":2200094,"rev":2,"signature":"SURICATA zero length padN option","category":"Generic Protocol Command Decode","severity":3}}
{"timestamp":"2018-05-21T13:05:55.757441+0200","flow_id":1612621304749411,"in_iface":"em1","event_type":"alert","src_ip":"fe80:0000:0000:0000:021c:42ff:fec0:d65f","dest_ip":"ff02:0000:0000:0000:0000:0000:0000:0016","proto":"IPV6-ICMP","icmp_type":143,"icmp_code":0,"alert":{"action":"allowed","gid":1,"signature_id":2200094,"rev":2,"signature":"SURICATA zero length padN option","category":"Generic Protocol Command Decode","severity":3}}
security/etpro-telemetry/testdata/rule-updater.config
Vendored
+4
View File
@@ -0,0 +1,4 @@
# autogenerated, do not edit.
[__properties__]
et_telemetry.deviceid=eeyahsei1nootu6aeJ5Eeghoohahxu4rahkiewu2bayeiv2eif