This repository was archived by the owner on Jan 18, 2024. It is now read-only.

new alert_json plugin with kafka capabilities#88

Open

jjptapia wants to merge 212 commits intofirnsy:masterfrom

redBorder:master

Commits on Mar 28, 2013

Created alert_json output plugin skeleton, and integrated in banyard2.
root
committed

Commits on Apr 3, 2013

Changed names under spo_alert_json. No funtionality changed except default output names
root
committed
Timestamp now printed in milisenconds, instead of string
root
committed
Each data type add it's own string to a json file now.
root
committed
FIXED: JSON invalid fields are not written at all. Before, a ",," was printed
root
committed

Commits on Apr 5, 2013

Commits on Apr 16, 2013

Commits on Apr 18, 2013

Commits on May 3, 2013

Commits on Jul 3, 2013

Bumped: version to 2-1.13-BETA

binf
authored and
eugpermar
committed
Last minute commit for a long waited needed feature and some little fix.

binf
authored and
eugpermar
committed
fixed: libwebsocket update collapsed a number of arguments into general struct.

firnsy
authored and
eugpermar
committed
updated: build bump and removal of beta tag pending release.

firnsy
authored and
eugpermar
committed
fixed: range logic was inadvertenly inverted.

firnsy
authored and
eugpermar
committed
fixed: lingering reference identifid during HUP operations.

firnsy
authored and
eugpermar
committed
added: handle situations where map files are not v2.

firnsy
authored and
eugpermar
committed
fixed: issue with signature insertion and v1/v2 sid-msg.map handling.

firnsy
authored and
eugpermar
committed
Parsed hosts and networks file in order to produce in spo_alert_json

root
authored and
eugpermar
committed
Added src_name, src_str, dst_name and dst_str to json fields, based on

root
authored and
eugpermar
committed
Added network identifications in source and destination ip

root
authored and
eugpermar
committed
Added geoIP support using maxmind GeoIP

root
authored and
eugpermar
committed
Fixed a possible memory leak.

root
authored and
eugpermar
committed
Fixed some possible memory leaks and enabled --enable-geo-ip in

root
authored and
eugpermar
committed
Updated librdkafka

root
authored and
eugpermar
committed
Added to sf_kafka a maximum queue length value

root
authored and
eugpermar
committed
Added json_output plugin

root
authored and
eugpermar
committed
Added json and geoIP libs conditional compile stuff in configure.in.
eugpermar
committed
fix: possible double free's on cleanup when HUP recieved.

firnsy
authored and
eugpermar
committed
FIX: sf_kafka did not compile if --enable-kafka were passed to compile
eugpermar
committed
Added priority and classification fields to alert_json plugin. Some fields will be always printed, too
eugpermar
committed
Added sensor_id capability
eugpermar
committed
Added sensor_id and sensor_name passed by params. We will send the country code in s_ip and dest_ip too.
eugpermar
committed
Using sf_ip from sfutils module, what simplifies a bit the name resolution
eugpermar
committed
FIXED: Sendig src_country twice by error
eugpermar
committed

Commits on Jul 4, 2013

Commits on Jul 8, 2013

The geoip library path is now passed by param.
eugpermar
committed

Commits on Jul 11, 2013

Added payload field
eugpermar
committed

Commits on Jul 13, 2013

Proto fallback value is now the same value as proto_id
eugpermar
committed

Commits on Jul 15, 2013

Commits on Jul 16, 2013

FIX: ipv4 were not passed by ntohl functions
eugpermar
committed

Commits on Jul 17, 2013

Commits on Jul 25, 2013

Timestamp resolution moved from miliseconds to seconds
eugpermar
committed

Commits on Jul 30, 2013

alert-json did not work if --enable-ipv6 was present (Redmine issue 620). Fixed
eugpermar
committed

Commits on Aug 1, 2013

Commits on Aug 7, 2013

Added kafka 0.8 support
eugpermar
committed

Commits on Aug 12, 2013

Workaround to solve bug in librdkafka.
eugpermar
committed

Commits on Aug 22, 2013

Changed some fields name.
eugpermar
committed

Commits on Aug 23, 2013

Commits on Sep 16, 2013

Changed some template names
eugpermar
committed

Commits on Sep 24, 2013

Deleted kafka 0.8 support. Fixed memory leak. Inserted some likely()
eugpermar
committed

Commits on Oct 9, 2013

Updated configure.in
eugpermar
committed

Commits on Nov 5, 2013

Added group_id and group_name in the parameters. domain_id renamed to domain_name, and domain->domain_id
eugpermar
committed

Commits on Nov 19, 2013

IP packets length and ethernet packets length are now aggregated in groups. Priority_name added.
eugpermar
committed

Commits on Nov 21, 2013

Commits on Nov 28, 2013

Update to current kafka api
eugpermar
committed

Commits on Dec 5, 2013

Commits on Dec 18, 2013

Solved a invalid write valgrind report. Don't sending ip,mac,vlans names by default.
eugpermar
committed

Commits on Dec 26, 2013

Commits on Jan 15, 2014

FIX: ETHDST_VENDOR without mac in switch.
eugpermar
committed

Commits on Apr 30, 2014

Commits on May 26, 2014

FIX: ethlen puts an extra 0 sometimes
eugpermar
committed

Commits on May 27, 2014

Commits on Jul 11, 2014

Deleted priority name. Now priority is always a name
eugpermar
committed

Commits on Jul 14, 2014

Commits on Jul 15, 2014

FIX: priority was sent even when there was no event
eugpermar
committed

Commits on Jul 16, 2014

FIX: Bad delivery message callback management
eugpermar
committed

Commits on Jul 17, 2014

Commits on Jul 18, 2014

Commits on Jul 21, 2014

Commits on Aug 28, 2014

Commits on Sep 1, 2014

Added rbutils/Makefile.in, and headers guards
eugpermar
committed

Commits on Sep 2, 2014

Increased syslog human-readable IP buffers size, in order to accomodate ipv6
eugpermar
committed

Commits on Oct 30, 2014

Commits on Mar 26, 2015

Included Extra Data counts in Records
Pablo Cantos
committed

Commits on Mar 30, 2015

Preparing spo_alert_json.c, plugbase.c and plugbase.h. Perhaps we will have to roll back to undo these changes.
Pablo Cantos
committed

Commits on Mar 31, 2015

Flush cached event after TIME_ALARM seconds: Setting Alarm
Pablo Cantos
committed

Commits on Apr 7, 2015

Changing the way spoolerProcessRecord works and including Extra Data in EventRecordNode->data
Pablo Cantos
committed
Fire remained events before closing spooler when EOF is reached
Pablo Cantos
committed

Commits on Apr 10, 2015

rd_unified2.c modified: fixing macro and actionOfEvent
Pablo Cantos
committed
Merge branch 'master' into ExtraData
Pablo Cantos
committed
spo_alert_json.c modified: getting events from spooler and producing kafka messages with extra data
Pablo Cantos
committed
Not sending src/dst net/name if they are empty
eugpermar
committed
Changed alert messages to should_drop and cant_drop
eugpermar
committed

Commits on Apr 13, 2015

Merge branch 'master' into ExtraData
Pablo Cantos
committed

Commits on Apr 14, 2015

Solving memory issues
Pablo Cantos
committed
Fixing/readjusting some pieces of code
Pablo Cantos
committed
Comment added to explain payload not matching
Pablo Cantos
committed
Merge branch 'master' into ExtraData
Pablo Cantos
committed
Firing the last cached event
Pablo Cantos
committed
define RB_EXTRADATA
Pablo Cantos
committed

Commits on Apr 15, 2015

Including macro RB_EXTRADATA in configure. Short change in spoolerExtraDataCacheClean().
Pablo Cantos
committed

Commits on Apr 17, 2015

Changing the way DEFAULT_JSON is defined. Including code to write URI and hostname as ExtraData.
Pablo Cantos
committed

Commits on Apr 28, 2015

changed file_sha256 by sha256 in spo_alert_json.c
Pablo Cantos
committed

Commits on May 22, 2015

Fixing .gitignore file
Pablo Cantos
committed
merging from master
Pablo Cantos
committed

Commits on Jul 1, 2015

Updated .gitignore
eugpermar
committed

Commits on Jul 10, 2015

SMTP ExtraData fields included
Pablo Cantos
committed

Commits on Jul 13, 2015

FIX: Last event discarded when opening a new snort.log file (redmine issue #4834)
Pablo Cantos
committed

Commits on Sep 29, 2015

Adding rbhttp library in the configure flags
eugpermar
committed

Commits on Sep 30, 2015

Commits on Oct 1, 2015

Commits on Oct 2, 2015

Commits on Oct 13, 2015

New properties http.max_connections and http.max_queued_messages
eugpermar
committed

Commits on Oct 14, 2015

Adapted barnyard2 to use librbhttp v1.0, and wrapping new properties
eugpermar
committed

Commits on Dec 18, 2015

Deleting deprecated comment
eugpermar
committed

Commits on Dec 21, 2015

Commits on Jan 13, 2016

Deleted deprecated "type" and "trheader" template
eugpermar
committed

Commits on Jan 14, 2016

Commits on Jan 28, 2016

New extraData: EVENT_INFO_FTP_USER

Ana Rey
authored and
eugpermar
committed
extradata: EVENT_INFO_SMB_UID EVENT_INFO_SMB_IS_UPLOAD

Ana Rey
authored and
eugpermar
committed

Commits on Feb 4, 2016

Commits on Feb 15, 2016

Release memory in kafka

Ana Rey
authored and
anarey
committed
Merge pull request #7 from anarey/feature/extra_data_bug2
eugpermar
committed
extradata: deleted "<" and ">" caracteres in email_sender element

Ana Rey
authored and
anarey
committed
extradata: email_destination in an array

Ana Rey
authored and
anarey
committed

Commits on Feb 22, 2016

Fix in Alarm Control for spoolerFireLastEvent()
Pablo Cantos
committed
Added spoolerPrint*() functions for debug purposes
Pablo Cantos
committed
Protection added when reading from spooler
Pablo Cantos
committed

Commits on Feb 23, 2016

Merge branch 'Feature/Managing_ExtraData_fields' of github.com:redBorder/barnyard2 into Feature/Managing_ExtraData_fields
Pablo Cantos
committed
Added spoolerPrint*Packet() functions for debug purposes
Pablo Cantos
committed
Some few lines of code fixed
Pablo Cantos
committed

Commits on Mar 10, 2016

Commits on Mar 15, 2016

Commits on Apr 27, 2016

Commits on Apr 29, 2022

change service script
David Vanhoucke
committed

Commits on May 11, 2022

Adding systemd service
manegron
committed

Commits on Nov 6, 2023

Commits on Nov 8, 2023

Commits on Apr 2, 2024

update process rpm creation
davidredborder
committed

Commits on Apr 11, 2024