csle_collector.ossec_ids_manager package

Subpackages

Submodules

csle_collector.ossec_ids_manager.ossec_ids_manager module

class csle_collector.ossec_ids_manager.ossec_ids_manager.OSSECIdsManagerServicer[source]

Bases: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerServicer

gRPC server for collecting OSSEC IDS statistics.

getOSSECIdsAlerts(request: ossec_ids_manager_pb2.GetOSSECIdsAlertsMsg, context: grpc.ServicerContext) → ossec_ids_manager_pb2.OSSECIdsLogDTO[source]

Gets the statistics of the OSSEC IDS log from a given timestamp

Parameters

  • request – the gRPC request

  • context – the gRPC context

Returns

a DTO with IDS statistics

getOSSECIdsMonitorStatus(request: ossec_ids_manager_pb2.GetOSSECIdsMonitorStatusMsg, context: grpc.ServicerContext) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Gets the status of the OSSEC IDS Monitor thread

Parameters

  • request – the gRPC request

  • context – the gRPC context

Returns

a DTO with the status of the IDS monitor

startOSSECIds(request: ossec_ids_manager_pb2.StartOSSECIdsMsg, context: grpc.ServicerContext) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Starts the OSSEC IDS

Parameters

  • request – the gRPC request

  • context – the gRPC context

Returns

a DTO with the status of the IDS and its monitor thread

startOSSECIdsMonitor(request: ossec_ids_manager_pb2.StartOSSECIdsMonitorMsg, context: grpc.ServicerContext) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Starts the OSSEC IDS monitor thread

Parameters

  • request – the gRPC request

  • context – the gRPC context

Returns

a DTO with the status of the IDS monitor thread

stopOSSECIds(request: ossec_ids_manager_pb2.StartOSSECIdsMsg, context: grpc.ServicerContext) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Stops the OSSEC IDS

Parameters

  • request – the gRPC request

  • context – the gRPC context

Returns

a DTO with the status of the IDS and its monitor thread

stopOSSECIdsMonitor(request: ossec_ids_manager_pb2.StartOSSECIdsMonitorMsg, context: grpc.ServicerContext) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Stops the OSSEC IDS monitor thread if it is running

Parameters

  • request – the gRPC request

  • context – the gRPC context

Returns

a DTO with the status of the IDS monitor thread

csle_collector.ossec_ids_manager.ossec_ids_manager.serve(port: int = 50047, log_dir: str = '/', max_workers: int = 10, log_file_name: str = 'ossec_ids_manager.log') → None[source]

Starts the gRPC server for managing clients

Parameters

  • port – the port that the server will listen to

  • log_dir – the directory to write the log file

  • log_file_name – the file name of the log

  • max_workers – the maximum number of GRPC workers

Returns

None

csle_collector.ossec_ids_manager.ossec_ids_manager_pb2 module

Generated protocol buffer code.

csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc module

Client and server classes corresponding to protobuf-defined services.

class csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManager[source]

Bases: object

Interface exported by the server

static getOSSECIdsAlerts(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)[source]
static getOSSECIdsMonitorStatus(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)[source]
static startOSSECIds(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)[source]
static startOSSECIdsMonitor(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)[source]
static stopOSSECIds(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)[source]
static stopOSSECIdsMonitor(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)[source]
class csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerServicer[source]

Bases: object

Interface exported by the server

getOSSECIdsAlerts(request, context)[source]

Missing associated documentation comment in .proto file.

getOSSECIdsMonitorStatus(request, context)[source]

Missing associated documentation comment in .proto file.

startOSSECIds(request, context)[source]

Missing associated documentation comment in .proto file.

startOSSECIdsMonitor(request, context)[source]

Missing associated documentation comment in .proto file.

stopOSSECIds(request, context)[source]

Missing associated documentation comment in .proto file.

stopOSSECIdsMonitor(request, context)[source]

Missing associated documentation comment in .proto file.

class csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub(channel)[source]

Bases: object

Interface exported by the server

csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.add_OSSECIdsManagerServicer_to_server(servicer, server)[source]

csle_collector.ossec_ids_manager.ossec_ids_manager_util module

class csle_collector.ossec_ids_manager.ossec_ids_manager_util.OSSecManagerUtil[source]

Bases: object

Class with utility functions related to the OSSEC IDS Manager

static check_ossec_ids_alerts() → List[csle_collector.ossec_ids_manager.dao.ossec_ids_alert.OSSECIDSAlert][source]

Reads alerts from the OSSEC IDS alerts log

Returns

a list of alerts

static ossec_ids_log_dto_empty() → ossec_ids_manager_pb2.OSSECIdsLogDTO[source]
Returns

an empty OSSECIdsLogDTO

static ossec_ids_log_dto_from_dict(d: Dict[str, Any]) → ossec_ids_manager_pb2.OSSECIdsLogDTO[source]

Converts a dict representation of a OSSECIDSLogDTO to a DTO

Parameters

d – the dict to convert

Returns

the converted DTO

static ossec_ids_log_dto_to_dict(ossec_ids_log_dto: ossec_ids_manager_pb2.OSSECIdsLogDTO) → Dict[str, Any][source]

Converts a OSSECIdsLogDTO to a dict

Parameters

ossec_ids_log_dto – the dto to convert

Returns

a dict representation of the DTO

static ossec_ids_monitor_dto_empty() → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]
Returns

An empty OSSECIdsMonitorDTO

static ossec_ids_monitor_dto_from_dict(d: Dict[str, Any]) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Converts a dict representation of a OSSECIDSMonitorDTO to a DTO

Parameters

d – the dict to convert

Returns

the converted DTO

static ossec_ids_monitor_dto_to_dict(ossec_ids_monitor_dto: ossec_ids_manager_pb2.OSSECIdsMonitorDTO) → Dict[str, Any][source]

Converts a OSSECIdsMonitorDTO to a dict

Parameters

ossec_ids_monitor_dto – the dto to convert

Returns

a dict representation of the DTO

static read_ossec_ids_data(episode_last_alert_ts: float) → csle_collector.ossec_ids_manager.dao.ossec_ids_alert_counters.OSSECIdsAlertCounters[source]

Measures metrics from the OSSEC ids

Parameters

  • env_config – environment configuration

  • episode_last_alert_ts – timestamp when the episode started

Returns

ids statistics

csle_collector.ossec_ids_manager.query_ossec_ids_manager module

csle_collector.ossec_ids_manager.query_ossec_ids_manager.get_ossec_ids_alerts(stub: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub, timestamp: float, log_file_path: str, timeout=60) → ossec_ids_manager_pb2.OSSECIdsLogDTO[source]

Queries the IDS manager for the data of the IDS log from a given time-step

Parameters

  • stub – the stub to send the remote gRPC to the server

  • timestamp – the timtestamp to parse the log from

  • log_file_path – path to the IDS log file to read

  • timeout – the GRPC timeout (seconds)

Returns

an IdsLogDTO with data of the IDS log

csle_collector.ossec_ids_manager.query_ossec_ids_manager.get_ossec_ids_monitor_status(stub: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub, timeout=60) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Queries the IDS manager for the status of the IDS monitor thread

Parameters

stub – the stub to send the remote gRPC to the server

Returns

an IdsMonitorDTO describing the status of the IDS monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.start_ossec_ids(stub: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub, timeout=60) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Sends a request to the OSSEC IDS manager to start the IDS

Parameters

  • stub – the stub to send the remote gRPC to the server

  • timeout – the GRPC timeout (seconds)

Returns

an OSSECIdsMonitorDTO describing the status of the IDS and its monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.start_ossec_ids_monitor(stub: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub, kafka_ip: str, kafka_port: int, log_file_path: str, time_step_len_seconds: int, timeout=60) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Sends a request to the IDS manager to start the IDS monitor thread

Parameters

  • kafka_ip – the ip of the Kafka server

  • kafka_port – the port of the Kafka server

  • log_file_path – the path top the IDS log

  • time_step_len_seconds – the length of one time-step

  • stub – the stub to send the remote gRPC to the server

  • timeout – the GRPC timeout (seconds)

Returns

an IdsMonitorDTO describing the status of the IDS monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.stop_ossec_ids(stub: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub, timeout=60) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Sends a request to the OSSEC IDS manager to stop the IDS

Parameters

  • stub – the stub to send the remote gRPC to the server

  • timeout – the GRPC timeout (seconds)

Returns

an OSSECIdsMonitorDTO describing the status of the IDS and its monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.stop_ossec_ids_monitor(stub: csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub, timeout=60) → ossec_ids_manager_pb2.OSSECIdsMonitorDTO[source]

Sends a request to the IDS manager to stop the IDS monitor thread

Parameters

  • stub – the stub to send the remote gRPC to the server

  • timeout – the GRPC timeout (seconds)

Returns

an IdsMonitorDTO describing the status of the IDS monitor thread

Module contents