view release on metacpan or  search on metacpan

src_bin/suricata_extract_submit  view on Meta::CPAN

#!/usr/bin/env perl

use File::Find::Rule;
use warnings;
use strict;
use Config::Tiny;
use File::Slurp qw(append_file write_file read_file);
use Time::Piece;
use File::MimeInfo::Magic;
use Net::Subnet qw(subnet_matcher);
use LWP::UserAgent;
use HTTP::Request::Common;
use File::Temp qw/ tempdir  /;
use File::Copy;
use POSIX 'strftime';
use Sys::Syslog;
use JSON;
use Sys::Hostname;
use Proc::PID::File;
use Pod::Usage;
use Getopt::Long;
use Web::ACL;

=head1 NAME

suricata_extract_submit - Submits files extracted by Suricata to mojo_cape_submit for detonation via CAPEv2

=head1 VERSION

1.0.0

=cut

sub version {
	print "suricata_extract_submit v. 1.0.0\n";
}

=head1 SYNOPSIS

suricata_extract_submit

*/5 * * * * /usr/local/bin/suricata_extract_submit 2> /dev/null > /dev/null

=head1 DESCRIPTION

What is printed to standard out is also sent to syslog.

This requires having the file-store output configured akin to below.

      - file-store:
          version: 2
          enabled: yes
          dir: /var/log/suricata/files
          write-fileinfo: yes
          stream-depth: 0
          force-hash: [sha1, md5]
          xff:
            enabled: no
            mode: extra-data
            deployment: reverse
            header: X-Forwarded-For

The force-hash values are optional as this script will automatically compute
those for inclusion as well SHA256.

This will use `/var/run/suricata_extract_submit.pid` as a PID file
to ensure only a single instance is running.

May be checked to see if it has hung like below. Below will alert if a PID
file with a M time of older than 5 minutes.

    /usr/local/libexec/nagios/check_file_age -i -f /var/run/suricata_extract_submit.pid

Safe to dump the output of this to dev null in cron as the output is also sent to syslog
as 'suricata_extract_submit' to the 'daemon' log.

=head1 CONFIGURATION

The config file used is '/usr/local/etc/suricata_extract_submit.ini'.

    # the API key to use if needed
    #apikey=

    # URL to find mojo_cape_submit at
    url=http://192.168.14.15:8080/

    # the group/client/whathaveya slug
    slug=foo

    # where Suricata has the file store at
    filestore=/var/log/suricata/files

    # a file of IPs or subnets to ignore SRC or DEST IPs of
    #ignore=

    # a file of regex to use for checking host names to ignore
    #ignoreHosts=

    # a file of regex to use for checking host names to ignore
    #ignoreHosts=

    # a file of regex to use for checking user agents to ignore
    #ignoreUAs=

    # a file of regex to use for checking path chunks of the URL to ignore
    #ignorePaths=

    # a file of regex to use for checking path chunks of the URL to ignore
    ignoreMaxSize=52428800

    # a JSON file to use for using with Web::ACL for checking for ignores
    #ignoreWebACL=/usr/local/etc/suricata_extract_submit_webacl.json

    # if it should use HTTPS_PROXY and HTTP_PROXY from ENV or not
    env_proxy=0

    # stats file holding only the stats for the last run
    stats_file=/var/cache/suricata_extract_submit_stats.json

    # stats dir
    stats_dir=/var/cache/suricata_extract_submit_stats/