py-idstools 
py-idstools is a collection of Python libraries for working with IDS systems (typically Snort and Suricata).
Features
Snort/Suricata unified2 log file reading.
Continuous unified2 directory spool reading with bookmarking (a’la Barnyard2).
Parser and mapping for classification.config.
Parser and mapping for gen-msg.map and sid-msg.map.
Useful utility programs.
Programs
u2json - Convert unified2 files or spool directories to JSON.
gensidmsgmap - Easily create a sid-msg.map file from rule files, directories or a rule tarball.
Requirements
Python 2.6 or 2.7; Python 3.3 works but is not as well tested.
Currently only tested on Linux.
Examples
Reading a Unified2 Spool Directory
The following code snippet will “tail” a unified log directory aggregating records into events:
from idstools import unified2
reader = unified2.SpoolEventReader("/var/log/snort",
"unified2.log", tail=True)
for event in reader:
print(event)
Documentation
Further documentation is located at http://idstools.readthedocs.org.
Changelog
0.4.0
New tool, u2json to convert unified2 files to JSON.
0.3.1
Support the new appid unified2 event types introduced in Snort 2.9.7.0.alpha.
1 maintainer
Metadata
1 maintainer
Release files for idstools 0.4.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| idstools-0.4.0.tar.gz | 38.6 kB | Without provenance | Details for idstools-0.4.0.tar.gz |
Release files / idstools-0.4.0.tar.gz
| Download URL | idstools-0.4.0.tar.gz |
|---|---|
| Size | 38.6 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
21a6d8b46afb457c78d2dda1dcc0c4979c34f810d6ab9f975d9f5d91f63c8189
|
|
BLAKE2b-256 checksum How to use checksums |
1c0ebfcb1e212b61ccefc1625c272dd387e3b8b5c81c9861cd4331a2b5751ca4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for idstools 0.4.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
