mirror of
https://github.com/activecm/rita
synced 2026-06-08 13:02:45 +00:00
Naomi Kramer
59 lines
2.6 KiB
Bash
Executable File
59 lines
2.6 KiB
Bash
Executable File
# directory to copy logs from
|
|
valid_data=./valid_tsv/
|
|
# directory for new logs
|
|
open_data=./open_conns
|
|
|
|
# create open conns
|
|
cat $valid_data/conn.log | head -n28 > $open_data/open/open_conn.log
|
|
# close open conns
|
|
cat $valid_data/conn.log | head -n28 > $open_data/closed/conn.log
|
|
# create header for closed conns for open import
|
|
cat $valid_data/conn.log | head -n8 > $open_data/open/conn.log
|
|
|
|
|
|
# create open http
|
|
cat $valid_data/http.log | head -n28 > $open_data/open/open_http.log
|
|
# close open http conns
|
|
cat $valid_data/http.log | head -n28 > $open_data/closed/http.log
|
|
# create header for closed http conns for open import
|
|
cat $valid_data/http.log | head -n8 > $open_data/open/http.log
|
|
# add closed http conns for open import, use end of file so that they don't overlap with open zeek uids
|
|
cat $valid_data/http.log | tail -n11 >> $open_data/open/http.log
|
|
|
|
# create open ssl
|
|
cat $valid_data/ssl.log | head -n28 > $open_data/open/open_ssl.log
|
|
# close open ssl conns
|
|
cat $valid_data/ssl.log | head -n28 > $open_data/closed/ssl.log
|
|
# create header for closed ssl conns for open import
|
|
cat $valid_data/ssl.log | head -n8 > $open_data/open/ssl.log
|
|
# add closed ssl conns for open import, use end of file so that they don't overlap with open zeek uids
|
|
cat $valid_data/ssl.log | tail -n11 >> $open_data/open/ssl.log
|
|
|
|
|
|
# copy matching conn log entries over to closed conn log in open import for closed http conns
|
|
grep "^[^#;]" $open_data/open/http.log | awk '{ print $2 }' | sort | uniq | sort -nr | while read -r uid rest; do
|
|
cat $valid_data/conn.log | grep $uid >> $open_data/open/conn.log
|
|
done
|
|
|
|
# copy matching conn log entries over to closed conn log in open import for closed ssl conns
|
|
grep "^[^#;]" $open_data/open/ssl.log | awk '{ print $2 }' | sort | uniq | sort -nr | while read -r uid rest; do
|
|
cat $valid_data/conn.log | grep $uid >> $open_data/open/conn.log
|
|
done
|
|
|
|
# add closed conns for open import
|
|
cat $valid_data/conn.log | tail -n11 >> $open_data/open/conn.log
|
|
|
|
|
|
# copy matching conn log entries over to closed conn log in closed import & open conn log in open import for http conns
|
|
grep "^[^#;]" $open_data/open/open_http.log | awk '{ print $2 }' | sort | uniq | sort -nr | while read -r uid rest; do
|
|
cat $valid_data/conn.log | grep $uid | tee -a $open_data/closed/conn.log >> $open_data/open/open_conn.log
|
|
done
|
|
|
|
# copy matching conn log entries over to closed conn log in closed import & open conn log in open import for ssl conns
|
|
grep "^[^#;]" $open_data/open/open_ssl.log | awk '{ print $2 }' | sort | uniq | sort -nr | while read -r uid rest; do
|
|
cat $valid_data/conn.log | grep $uid | tee -a $open_data/closed/conn.log >> $open_data/open/open_conn.log
|
|
done
|
|
|
|
|
|
|