Skip to main content

IDS Utility Library

Project description

py-idstools is a collection of Python libraries for working with IDS systems (typically Snort and Suricata).

Features

  • Snort/Suricata unified2 log file reading.

  • Continuous unified2 directory spool reading with bookmarking (a’la Barnyard2).

  • Parser and mapping for classification.config.

  • Parser and mapping for gen-msg.map and sid-msg.map.

  • Useful utility programs.

Programs

  • u2json - Convert unified2 files or spool directories to JSON.

  • gensidmsgmap - Easily create a sid-msg.map file from rule files, directories or a rule tarball.

Requirements

  • Python 2.6 or 2.7; Python 3.3 works but is not as well tested.

  • Currently only tested on Linux.

Examples

Reading a Unified2 Spool Directory

The following code snippet will “tail” a unified log directory aggregating records into events:

from idstools import unified2

reader = unified2.SpoolEventReader("/var/log/snort",
    "unified2.log", tail=True)
for event in reader:
    print(event)

Documentation

Further documentation is located at http://idstools.readthedocs.org.

Changelog

0.4.0

  • New tool, u2json to convert unified2 files to JSON.

0.3.1

  • Support the new appid unified2 event types introduced in Snort 2.9.7.0.alpha.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

idstools-0.4.0.tar.gz (38.6 kB view details)

Uploaded Source

File details

Details for the file idstools-0.4.0.tar.gz.

File metadata

  • Download URL: idstools-0.4.0.tar.gz
  • Upload date:
  • Size: 38.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No

File hashes

Hashes for idstools-0.4.0.tar.gz
Algorithm Hash digest
SHA256 21a6d8b46afb457c78d2dda1dcc0c4979c34f810d6ab9f975d9f5d91f63c8189
MD5 7c27b41a727b4105831640682e90442d
BLAKE2b-256 1c0ebfcb1e212b61ccefc1625c272dd387e3b8b5c81c9861cd4331a2b5751ca4

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page