configurations/generate-analyzer-ids.py at main · DynamiteAI/configurations · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
import json

from dynamite_nsm import utilities
from dynamite_nsm.services.base.config_objects.generic import Analyzers
from dynamite_nsm.services.base.config_objects.zeek.local_site import Script
from dynamite_nsm.services.base.config_objects.suricata.rules import Rule
from dynamite_nsm.services.zeek.config import lookup_script_definition
from dynamite_nsm.services.zeek.config import SiteLocalConfigManager
from dynamite_nsm.services.suricata.config import lookup_rule_definition
from dynamite_nsm.services.suricata.config import ConfigManager as SuricataConfigManager

env = utilities.get_environment_file_dict()

ZEEK_SCRIPTS = env.get('ZEEK_SCRIPTS')
SURICATA_CONFIG = env.get('SURICATA_CONFIG')


zeek_scripts = SiteLocalConfigManager(ZEEK_SCRIPTS).scripts
suricata_rules = SuricataConfigManager(SURICATA_CONFIG).rules


def find_undefined(analyzers: Analyzers):
    undefined_analyzers = []
    for analyzer in analyzers:
        lookup = None
        if isinstance(analyzer, Script):
            lookup = lookup_script_definition(analyzer.id)
        elif isinstance(analyzer, Rule):
            lookup = lookup_rule_definition(analyzer.id)
        if not lookup:
            undefined_analyzers.append(analyzer)
    return undefined_analyzers


def find_collisions(analyzers: Analyzers):
    collision_analyzers = []
    analyzer_ids = {}
    for analyzer in analyzers:
        if analyzer_ids.get(analyzer.id):
            analyzer_ids[analyzer.id] += 1
        else:
            analyzer_ids[analyzer.id] = 1

    for _id, count in analyzer_ids.items():
        if count > 1:
            collision_analyzers.append(analyzers.get(_id))
    return collision_analyzers


def find_undefined_rules():
    return find_undefined(suricata_rules)


def find_collision_rules():
    return find_collisions(suricata_rules)


def find_undefined_scripts():
    return find_undefined(zeek_scripts)


def find_collision_scripts():
    return find_collisions(zeek_scripts)


def organize_definitions(definitions_fp: str):
    definitions = dict(json.load(open(definitions_fp)))
    ordered_definitions = {}
    group_keys = set()
    for _, metadata in definitions.items():
        group_key = ''.join(sorted(metadata.get('categories')))
        group_keys.add(group_key)

    group_keys = sorted(list(group_keys), key=lambda k: len(k))

    for group_key in group_keys:
        for _id, metadata in definitions.items():
            test_key = ''.join(sorted(metadata.get('categories')))
            if test_key == group_key:
                ordered_definitions.update({_id: metadata})

    return ordered_definitions


for s in find_undefined_scripts():
    print(s)