dc5553

dump snort rules to mysql

Jun 26th, 2011
168
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 1.63 KB | None | 0 0
  1. #!/usr/bin/python
  2. # coding: utf-8
  3. import sys,MySQLdb,os,re
  4.  
  5.  
  6. def dogpile(rulerepo):
  7.     x = 0
  8.     try:
  9.          conn = MySQLdb.connect (host = "localhost",
  10.                                  user = "root",
  11.                                  passwd = "",
  12.                                  db = "snortdb")
  13.     except MySQLdb.Error, e:
  14.          print "Error %d: %s" % (e.args[0], e.args[1])
  15.          sys.exit (1)        
  16.     if conn:
  17.         print "sucessfully connected to database"
  18.         cursor = conn.cursor()
  19.         cursor.execute("DROP TABLE IF EXISTS snortrules")
  20.         cursor.execute("""
  21.           CREATE TABLE snortrules
  22.           (
  23.             sid     INT UNSIGNED,
  24.             rule    TEXT(2048) NOT NULL,
  25.             PRIMARY KEY(sid),
  26.             INDEX ruleindex(rule(767))
  27.           )
  28.         """)    
  29.     """get the rules"""
  30.     for root, dir, files in os.walk(str(rulerepo)):
  31.         for file in files:
  32.             if ".rules" in file:
  33.                 openrule = open(root + '/' + file)
  34.                 readrule = openrule.read()
  35.                 alertrules = re.findall(r'alert.*rev:\d\;\)',readrule)
  36.                 for snortrule in alertrules:
  37.                     sidnum = ''.join(re.findall(r'sid:(\d*)',snortrule))
  38.                     cursor.execute ("""
  39.           INSERT INTO snortrules (sid,rule)
  40.           VALUES(%s,%s)""",(sidnum,snortrule))
  41.                     x += 1
  42.     print "\nNumber of rows inserted: " + str(x)    
  43.     conn.commit()
  44.     cursor.close()
  45.     conn.close()
  46.  
  47. def main():
  48.     rulerepo = sys.argv[1]
  49.     dogpile(rulerepo)
  50.  
  51.  
  52. if __name__ == '__main__':
  53.     main()
Add Comment
Please, Sign In to add comment