py-idstools 
py-idstools is a collection of Python libraries for working with IDS systems (typically Snort and Suricata).
Features
Snort/Suricata unified2 log file reading.
Continuous unified2 directory spool reading with bookmarking (a’la Barnyard2).
Parser and mapping for classification.config.
Parser and mapping for gen-msg.map and sid-msg.map.
Useful utility programs.
Programs
u2json - Convert unified2 files or spool directories to JSON.
gensidmsgmap - Easily create a sid-msg.map file from rule files, directories or a rule tarball.
Requirements
Python 2.6 or 2.7; Python 3.3 works but is not as well tested.
Currently only tested on Linux.
Examples
Reading a Unified2 Spool Directory
The following code snippet will “tail” a unified log directory aggregating records into events:
from idstools import unified2
reader = unified2.SpoolEventReader("/var/log/snort",
"unified2.log", tail=True)
for event in reader:
print(event)
Documentation
Further documentation is located at http://idstools.readthedocs.org.
Changelog
0.4.0
New tool, u2json to convert unified2 files to JSON.
0.3.1
Support the new appid unified2 event types introduced in Snort 2.9.7.0.alpha.
1 maintainer
Metadata
1 maintainer
Release files for idstools 0.4.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| idstools-0.4.0.tar.gz | 38.6 kB | Details |
Release files / idstools-0.4.0.tar.gz
| Download URL | idstools-0.4.0.tar.gz |
|---|---|
| Size | 38.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
21a6d8b46afb457c78d2dda1dcc0c4979c34f810d6ab9f975d9f5d91f63c8189
|
|
BLAKE2b-256 checksum How to use checksums |
1c0ebfcb1e212b61ccefc1625c272dd387e3b8b5c81c9861cd4331a2b5751ca4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
