Skip to main content

IDS Utility Library

Project description

py-idstools is a collection of Python libraries for working with IDS systems (typically Snort and Suricata).

Features

  • Snort/Suricata unified2 log file reading.
  • Continuous unified2 directory spool reading with bookmarking (a’la Barnyard2).
  • Parser and mapping for classification.config.
  • Parser and mapping for gen-msg.map and sid-msg.map.

Requirements

  • Python 2.6 or 2.7; Python 3.3 works but is not as well tested.
  • Currently only tested on Linux.

Examples

Reading a Unified2 Spool Directory

The following code snippet will “tail” a unified log directory aggregating records into events:

from idstools import unified2

reader = unified2.SpoolEventReader("/var/log/snort",
    "unified2.log", tail=True)
for event in reader:
    print(event)

Documentation

Further documentation is located at http://idstools.readthedocs.org.

Changelog

0.3.1

  • Support the new appid unified2 event types introduced in Snort 2.9.7.0.alpha.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Files for idstools, version 0.3.1
Filename, size File type Python version Upload date Hashes
Filename, size idstools-0.3.1.tar.gz (16.0 kB) File type Source Python version None Upload date Hashes View

Supported by

Pingdom Pingdom Monitoring Google Google Object Storage and Download Analytics Sentry Sentry Error logging AWS AWS Cloud computing DataDog DataDog Monitoring Fastly Fastly CDN DigiCert DigiCert EV certificate StatusPage StatusPage Status page