Algorithm-ToNumberMunger
view release on metacpan or search on metacpan
lib/Algorithm/ToNumberMunger.pm view on Meta::CPAN
This one maps DNS RCODE names to their IANA values: C<NOERROR> 0, C<FORMERR>
1, C<SERVFAIL> 2, C<NXDOMAIN> 3, C<NOTIMP> 4 (alias C<NOTIMPL>), C<REFUSED> 5,
C<YXDOMAIN> 6, C<YXRRSET> 7, C<NXRRSET> 8, C<NOTAUTH> 9, C<NOTZONE> 10,
C<DSOTYPENI> 11, and the extended rcodes C<BADVERS>/C<BADSIG> 16, C<BADKEY>
17, C<BADTIME> 18, C<BADMODE> 19, C<BADNAME> 20, C<BADALG> 21, C<BADTRUNC> 22,
C<BADCOOKIE> 23.
=head2 dns_qtype_enum
{ munger => 'dns_qtype_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>; numeric inputs pass
through) mapping DNS RR type names to their IANA numbers: C<A> 1, C<NS> 2,
C<CNAME> 5, C<SOA> 6, C<NULL> 10, C<PTR> 12, C<MX> 15, C<TXT> 16, C<AAAA> 28,
C<SRV> 33, C<NAPTR> 35, C<DS> 43, C<RRSIG> 46, C<DNSKEY> 48, C<TLSA> 52,
C<SVCB> 64, C<HTTPS> 65, C<AXFR> 252, C<ANY> (or C<*>) 255, C<URI> 256,
C<CAA> 257, and the rest of the commonly-observed registry. The query-type mix
is a classic DNS-tunneling feature -- C<TXT>/C<NULL>-heavy traffic where
C<A>/C<AAAA> is normal.
=head2 syslog_severity_enum
{ munger => 'syslog_severity_enum' }
Named-map enum (lookup rules as L</dns_rcode_enum>; numeric inputs pass
through) mapping syslog severity names to their RFC 5424 codes: C<emerg> 0
(alias C<panic>), C<alert> 1, C<crit> 2, C<err> 3 (alias C<error>),
C<warning> 4 (alias C<warn>), C<notice> 5, C<info> 6 (alias
C<informational>), C<debug> 7. Genuinely ordinal -- lower is more severe --
so a threshold split on it is meaningful.
=head2 syslog_facility_enum
{ munger => 'syslog_facility_enum' }
Named-map enum (lookup rules as L</dns_rcode_enum>; numeric inputs pass
through) mapping syslog facility names to their RFC 5424 codes: C<kern> 0,
C<user> 1, C<mail> 2, C<daemon> 3, C<auth> 4 (alias C<security>), C<syslog> 5,
C<lpr> 6, C<news> 7, C<uucp> 8, C<cron> 9, C<authpriv> 10, C<ftp> 11, C<ntp>
12, C<audit> 13, C<alert> 14, C<clock> 15, and C<local0>-C<local7> 16-23.
=head2 ip_proto_enum
{ munger => 'ip_proto_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>; numeric inputs pass
through) mapping IP protocol names to their IANA protocol numbers: C<icmp> 1,
C<igmp> 2, C<ipip> 4 (alias C<ipencap>), C<tcp> 6, C<egp> 8, C<udp> 17,
C<dccp> 33, C<ipv6> 41, C<rsvp> 46, C<gre> 47, C<esp> 50, C<ah> 51,
C<icmpv6> 58 (alias C<ipv6-icmp>), C<ospf> 89, C<pim> 103, C<sctp> 132,
C<udplite> 136. The map is frozen here rather than delegated to
C<getprotobyname> so a value munges to the same number on every host.
=head2 tls_version_enum
{ munger => 'tls_version_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) mapping a TLS/SSL protocol
version name to an B<ordinal>: C<SSLv2> 0, C<SSLv3> 1, C<TLSv1> 2, C<TLSv1.1>
3, C<TLSv1.2> 4, C<TLSv1.3> 5, with the common spelling variants (C<ssl3>,
C<tls1.2>, ...) accepted. Ordinal so "older than expected" is a monotone
feature a threshold split can express. Because these ordinals are this
module's invention rather than a wire encoding, numeric inputs are B<not>
passed through -- a C<1.2> would land on the wrong scale -- and croak like
any other unmapped value (or take the C<default>).
=head2 http_method_enum
{ munger => 'http_method_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for the registered HTTP
request methods: C<GET> 0, C<HEAD> 1, C<POST> 2, C<PUT> 3, C<DELETE> 4,
C<CONNECT> 5, C<OPTIONS> 6, C<TRACE> 7, C<PATCH> 8. HTTP has no numeric
method encoding, so these are unordered ordinals of this module's invention
(a canonical map beats every set inventing its own numbering) and numeric
inputs are not passed through. An unlisted -- possibly probing -- method
croaks unless a C<default> is given, and that unlisted-method signal is often
the interesting one.
=head2 sip_method_enum
{ munger => 'sip_method_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for the SIP request
methods: C<INVITE> 0, C<ACK> 1, C<BYE> 2, C<CANCEL> 3, C<REGISTER> 4,
C<OPTIONS> 5, C<PRACK> 6, C<SUBSCRIBE> 7, C<NOTIFY> 8, C<PUBLISH> 9,
C<INFO> 10, C<REFER> 11, C<MESSAGE> 12, C<UPDATE> 13. Like
L</http_method_enum> these are ordinals of this module's invention, so
numeric inputs are not passed through.
=head2 dhcp_msgtype_enum
{ munger => 'dhcp_msgtype_enum' }
Named-map enum (lookup rules as L</dns_rcode_enum>; numeric inputs pass
through) mapping DHCP message-type names to their option-53 values:
C<DISCOVER> 1, C<OFFER> 2, C<REQUEST> 3, C<DECLINE> 4, C<ACK> 5, C<NAK> 6,
C<RELEASE> 7, C<INFORM> 8 -- each also accepted with the C<DHCP> prefix
(C<DHCPDISCOVER>, ...) that most tooling logs.
=head2 app_proto_enum
{ munger => 'app_proto_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for Suricata's
C<app_proto> field -- the detected application-layer protocol on a flow or
alert (C<http>, C<dns>, C<tls>, C<ssh>, C<smtp>, C<dcerpc>, C<quic>, ...),
including C<failed> and C<unknown>, which are usually the very rows worth
keeping. These are unordered ordinals of this module's invention (Suricata
logs a string, not a number), so numeric inputs are B<not> passed through.
C<ssl> is accepted as an alias for C<tls> and C<ikev2> for C<ike>. This is
distinct from L</ip_proto_enum>, which numbers the L4 protocol
(C<tcp>/C<udp>/...) rather than the app layer riding on it.
=head2 tcp_state_enum
{ munger => 'tcp_state_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) mapping the TCP state
machine, as Suricata logs it under C<flow.tcp.state>, to an B<ordinal> along
the connection lifecycle: C<none> 0, C<syn_sent> 1, C<syn_recv> 2,
C<established> 3, C<fin_wait1> 4, C<fin_wait2> 5, C<closing> 6, C<time_wait>
7, C<close_wait> 8, C<last_ack> 9, C<closed> 10. Ordinal so "further along
teardown than expected" is a monotone feature a threshold split can express.
Being ordinals of our own invention, numeric inputs are not passed through.
=head2 flow_state_enum
{ munger => 'flow_state_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for Suricata's
C<flow.state>: C<new> 0, C<established> 1, C<closed> 2, C<bypassed> 3,
C<local_bypass> 4 -- roughly ordinal along the flow lifecycle. Numeric inputs
are not passed through.
=head2 flow_reason_enum
{ munger => 'flow_reason_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for Suricata's
C<flow.reason>, why a flow was logged out: C<timeout> 0, C<forced> 1,
C<shutdown> 2, C<unknown> 3. Numeric inputs are not passed through.
=head2 suricata_action_enum
{ munger => 'suricata_action_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for Suricata's
C<alert.action> and the related rule/drop actions: C<allowed> 0, C<blocked>
1, C<pass> 2, C<drop> 3, C<reject> 4, C<alert> 5. In IDS mode the field is
C<allowed>/C<blocked>; the rule-action names are accepted too for IPS feeds
and C<drop> events. Numeric inputs are not passed through.
=head2 postfix_status_enum
{ munger => 'postfix_status_enum', default => -1 }
Named-map enum (lookup rules as L</dns_rcode_enum>) for Postfix's delivery
C<status=> disposition, numbered in a rough sent-to-failed severity order so
a threshold split is meaningful: C<sent> 0, C<deferred> 1, C<bounced> 2,
C<expired> 3, C<deliverable> 4, C<undeliverable> 5, C<hold> 6, C<discard> 7,
C<filtered> 8, C<reject> 9, C<softbounce> 10. Stock delivery agents emit only
C<sent>/C<deferred>/C<bounced>/C<expired>; C<deliverable>/C<undeliverable> come
from address verification (C<verify>), and the remainder cover HOLD/DISCARD
actions and values common log normalizers emit. Being labels of this module's
numbering, numeric inputs are not passed through.
=head2 spf_result_enum
{ munger => 'spf_result_enum', default => -1 }
lib/Algorithm/ToNumberMunger.pm view on Meta::CPAN
err => 3,
error => 3,
warning => 4,
warn => 4,
notice => 5,
info => 6,
informational => 6,
debug => 7,
},
},
syslog_facility => {
numeric => 1,
map => {
kern => 0,
user => 1,
mail => 2,
daemon => 3,
auth => 4,
security => 4,
syslog => 5,
lpr => 6,
news => 7,
uucp => 8,
cron => 9,
authpriv => 10,
ftp => 11,
ntp => 12,
audit => 13,
alert => 14,
clock => 15,
( map { ( "local$_" => 16 + $_ ) } 0 .. 7 ),
},
},
ip_proto => {
numeric => 1,
map => {
icmp => 1,
igmp => 2,
ipip => 4,
ipencap => 4,
tcp => 6,
egp => 8,
udp => 17,
dccp => 33,
ipv6 => 41,
rsvp => 46,
gre => 47,
esp => 50,
ah => 51,
icmpv6 => 58,
'ipv6-icmp' => 58,
ospf => 89,
pim => 103,
sctp => 132,
udplite => 136,
},
},
tls_version => {
numeric => 0,
map => {
sslv2 => 0,
ssl2 => 0,
sslv3 => 1,
ssl3 => 1,
tlsv1 => 2,
'tlsv1.0' => 2,
tls1 => 2,
'tls1.0' => 2,
'tlsv1.1' => 3,
'tls1.1' => 3,
'tlsv1.2' => 4,
'tls1.2' => 4,
'tlsv1.3' => 5,
'tls1.3' => 5,
},
},
http_method => {
numeric => 0,
map => {
get => 0,
head => 1,
post => 2,
put => 3,
delete => 4,
connect => 5,
options => 6,
trace => 7,
patch => 8,
},
},
sip_method => {
numeric => 0,
map => {
invite => 0,
ack => 1,
bye => 2,
cancel => 3,
register => 4,
options => 5,
prack => 6,
subscribe => 7,
notify => 8,
publish => 9,
info => 10,
refer => 11,
message => 12,
update => 13,
},
},
dhcp_msgtype => {
numeric => 1,
map => {
(
map { ( $_->[0] => $_->[1], "dhcp$_->[0]" => $_->[1] ) } [ discover => 1 ],
[ offer => 2 ],
[ request => 3 ],
[ decline => 4 ],
[ ack => 5 ],
[ nak => 6 ],
[ release => 7 ],
[ inform => 8 ]
),
},
},
app_proto => {
numeric => 0,
map => {
# Ordinals of our own invention (Suricata's app_proto is a string
# label with no wire number), assigned from a fixed order so a value
# munges to the same number on every host. 'failed'/'unknown' are
# kept as their own classes -- an un-parsed app layer is often the
# interesting row.
do {
my @order = qw(
unknown failed http http2 ftp ftp-data smtp imap
tls ssh smb dcerpc dns modbus enip dnp3 nfs ntp
tftp ike krb5 quic dhcp snmp sip rfb mqtt rdp
telnet pgsql ldap websocket bittorrent-dht
);
my %m = map { $order[$_] => $_ } 0 .. $#order;
$m{ssl} = $m{tls}; # Suricata's older spelling
$m{ikev2} = $m{ike};
%m;
},
},
},
tcp_state => {
numeric => 0,
map => {
# The TCP state machine (flow.tcp.state), numbered along the
# connection lifecycle so the ordinal is meaningful.
do {
my @order = qw(
none syn_sent syn_recv established
fin_wait1 fin_wait2 closing time_wait
close_wait last_ack closed
);
map { $order[$_] => $_ } 0 .. $#order;
},
},
},
flow_state => {
numeric => 0,
map => {
new => 0,
established => 1,
closed => 2,
bypassed => 3,
local_bypass => 4,
},
},
flow_reason => {
numeric => 0,
map => {
timeout => 0,
forced => 1,
shutdown => 2,
unknown => 3,
},
},
suricata_action => {
numeric => 0,
map => {
allowed => 0,
blocked => 1,
pass => 2,
drop => 3,
reject => 4,
alert => 5,
},
},
postfix_status => {
numeric => 0,
map => {
sent => 0,
deferred => 1,
bounced => 2,
expired => 3,
deliverable => 4,
undeliverable => 5,
hold => 6,
( run in 2.124 seconds using v1.01-cache-2.11-cpan-acf6aa7dc9e )