|
-- event_name
|
|
event_name = "http_audit"
|
|
|
|
-- event_type
|
|
event_type = "lua"
|
|
|
|
-- logs
|
|
name = "http_audit.txt"
|
|
|
|
|
|
-- defind function
|
|
function urlDecode(args)
|
|
s = string.gsub(args, "%%(%x%x)", function(h) return string.char(tonumber(h, 16)) end)
|
|
return s
|
|
end
|
|
|
|
function string.split(s, p)
|
|
rt = {}
|
|
string.gsub(s, '[^'..p..']+', function(w) table.insert(rt, w) end )
|
|
return rt
|
|
end
|
|
|
|
|
|
-- default funtion
|
|
function init(args)
|
|
local needs = {}
|
|
needs["protocol"] = "http"
|
|
return needs
|
|
end
|
|
|
|
function setup(args)
|
|
filename = SCLogPath() .. "/" .. name
|
|
file = assert(io.open(filename, "a"))
|
|
SCLogInfo("HTTP Audit Log Filename " .. filename)
|
|
http = 0
|
|
end
|
|
|
|
function log(args)
|
|
|
|
-- http_hostname
|
|
http_host = HttpGetRequestHost()
|
|
|
|
if http_host == nil then
|
|
return
|
|
end
|
|
|
|
-- http_url
|
|
http_url = HttpGetRequestUriNormalized()
|
|
|
|
-- http_url_path
|
|
http_url_path = string.split(http_url, "?")[1]
|
|
|
|
-- http_method
|
|
rl = HttpGetRequestLine()
|
|
http_method = string.match(rl, "%w+")
|
|
|
|
-- http_status
|
|
rsl = HttpGetResponseLine()
|
|
status_code = string.match(rsl, "%s(%d+)%s")
|
|
http_status = tonumber(status_code)
|
|
|
|
-- http_protocol
|
|
http_protocol = string.match(rsl, "(.-)%s")
|
|
|
|
-- timestring = SCPacketTimeString() 2019-09-10T06:08:35.582449+0000
|
|
sec, usec = SCPacketTimestamp()
|
|
timestring = os.date("!%Y-%m-%dT%T", sec) .. "." .. usec .. "+0000"
|
|
|
|
-- flow_info
|
|
ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCFlowTuple()
|
|
|
|
-- flow_id
|
|
id = SCFlowId()
|
|
flow_id = string.format("%.0f", id)
|
|
|
|
file:write (timestring .. " " .. http_host .. " [**] " .. http_url .. " [**] " .. " [**] " .. src_ip .. ":" .. src_port .. " -> " .. dst_ip .. ":" .. dst_port .. "\n")
|
|
file:flush()
|
|
http = http + 1
|
|
end
|
|
|
|
function deinit (args)
|
|
SCLogInfo ("HTTP transactions logged: " .. http);
|
|
file:close(file)
|
|
end
|