Name

snortdb2xml — Retreive IDS alert event and signature information from an IDS collector MySQL database with resulting output in XML format.

Synopsis

snortdb2xml [ -m ENTRY | --mode ENTRY ] [ -u TEXT | --snort-user TEXT ] [ -p TEXT | --snort-passwd TEXT ] [ -s HOSTNAME|IPv4ADDR | --server HOSTNAME|IPv4ADDR ] [ -p PORT | --port PORT ] [ -l [true]|false | --loopback [true]|false ] [ --start-event-time DATE ] [ --end-event-time DATE ] [ --sensor-filter TEXT ] [ --netint-filter TEXT ] [ --annotation TEXT ] [ -d [true]|false | --debug [true]|false ] [ -h [true]|false | --help [true]|false ] [ -H [true]|false | --help-long [true]|false ] [ -v [true]|false | --verbose [true]|false ] [ --version [true]|false ]

Overview

The snortdb2xml script will retrieve IDS Alert Event data and Sensor information from a IDS collector MySQL database and generate output in XML format. The IDS collector MySQL database may be located locally or on a remote system.

Options

The following command line options are available:

[-m ENTRY] | [--mode ENTRY]

This option controls what the snortdb2xml script will do. The following modes are available: ("xml-ids", "xml-sensor" and "bash"). If you specify "xml-ids" (the default), this script will retrieve IDS alert event data from an IDS collector MySQL database and generate output in XML (Extensible Markup Language) formatted text to standard output (display). If you specify "xml-sensor", this script will retrieve IDS Engine Sensor information from an IDS collector MySQL database and generate output in XML formatted text to standard output (display). Specify "bash" to display internal 'Bash' variables specific to snortdb2xml for 'Bash' scripting integration.

[-u TEXT] | [--snort-user TEXT]

This optional parameter allows one to specify an alternative user name for accessing the IDS collector MySQL database. The default user name is: "snort"

[-p TEXT] | [--snort-passwd TEXT]

Use this optional parameter to specify a Clear Text Password necessary for accessing the IDS collector MySQL database. If this option is not used, the password associated with the "NSTCTSNORTPASSWD" configuration entry found in the NST configuration file: "/etc/nst.conf" will be used.

[-s HOSTNAME|IPv4ADDR] | [--server HOSTNAME|IPv4ADDR]

Use this optional parameter to specify the IDS collector MySQL database server (IP Address or Host Name). A default value of "127.0.0.1" (localhost) will be used if the server parameter is not specified.

[-p PORT] | [--port PORT]

Use this option to specify the TCP/IP port number to use to connect to the IDS collector MySQL database if it is different from the default port value of "3306".

[-l [true]|false] | [--loopback [true]|false]

Use this option for overriding the "--server" value when accessing the MySQL database. One can still set the "--server" option for linkage back to the NST WUI from within Google Earth when generating a KML document.

[--start-event-time DATE]

Use this optional value to specify the "Start Time" of the first IDS Alert Event to retrieve from the IDS collector MySQL database. If this option is omitted, the Unix epoch time (i.e., 1970-01-01 00:00:00) will be used. Use the following formatted date/time string enclosed in double quotes when specifying this option: "YYYY-MM-DD hh:mm:ss" where: YY - Year, MM - Month, DD - Day, hh - Hour, mm - Minute and ss - Second.

[--end-event-time DATE]

Use this optional value to specify the "End Time" of the last IDS Alert Event to retrieve from the IDS collector MySQL database. If this option is omitted, the current date and time will be used. Use the following formatted date/time string enclosed in double quotes when specifying this option: "YYYY-MM-DD hh:mm:ss" where: YY - Year, MM - Month, DD - Day, hh - Hour, mm - Minute and ss - Second.

[--sensor-filter TEXT]

Use this optional parameter to specify a IDS Engine Sensor name filter to be added as a search criterion when retrieving IDS alert events. The "space" and "underscore" characters are interchangeable when specifying the "--sensor-filter" name. Enclose the sensor name filter in double quotes if you choose to uses spaces. If this option is used, it is best to match it with the cooresponding network interface filter: "--netint-filter" option to correctly identify the "IDS Engine Sensor" with its associated "Network Interface". ***Note: If the "--netint-filter" option is used and this option is not, the First Matched IDS Engine Sensor name will be used in the MySQL query selection when retrieving IDS data or information.

[--netint-filter TEXT]

Use this optional parameter to specify an IDS Network Interface filter to be added as a search criterion when retrieving IDS alert events. If this option is used, it is best to match it with the cooresponding IDS Engine Sensor name filter: "--sensor-filter" option to correctly identify the "IDS Engine Sensor" with its associated "Network Interface". ***Note: If the "--sensor-filter" option is used and this option is not, the First Matched IDS Network Interface name will be used in the MySQL query selection when retrieving IDS data or information.

[--annotation TEXT]

Use this option to add an "Annotation" to the generated IDS XML output. This is used to document the results for historical review and analysis. Enclose the annotation with single or double quotes.

[-d [true]|false] | [--debug [true]|false]

Use this option to enable debug output. This option is mainly used by developers. Output will be switched to table format.

[-h [true]|false] | [--help [true]|false]

When this option is specified, snortdb2xml will display a short one line description of snortdb2xml, followed by a short description of each of the supported command line options. After displaying this information snortdb2xml will terminate.

[-H [true]|false] | [--help-long [true]|false]

This option will attempt to pull up additional snortdb2xml documentation within a text based web browser. You can force which browser we use setting the environment variable TEXTBROWSER, otherwise, we will search for some common ones.

[-v [true]|false] | [--verbose [true]|false]

When you set this option to true, snortdb2xml will produce additional output. This is typically used for diagnostic purposes to help track down when things go wrong.

[--version [true]|false]

If this option is specified, the version number of the script is displayed.

Files

/etc/nst.conf

File containing the IDS collector MySQL database clear text password that may be used as a default value by this script (See value for configuration entry: 'NSTCTSNORTPASSWD').

/usr/share/snortdb2xml

Directory containing resource files used by snortdb2xml.

Environment

TEXTBROWSER

This controls what text based browser is used to display help information about the script. If not set, we will search your system for available text-based browsers (Ex: elinks, lynx ...).

See Also

nstnewscript(1), Network Security Toolkit