csle_collector.ossec_ids_manager package

Subpackages

• csle_collector.ossec_ids_manager.dao package
  • Submodules
  • csle_collector.ossec_ids_manager.dao.ossec_ids_alert module
    • OSSECIDSAlert
      • OSSECIDSAlert.copy()
      • OSSECIDSAlert.from_dict()
      • OSSECIDSAlert.from_json_file()
      • OSSECIDSAlert.get_group_id()
      • OSSECIDSAlert.to_dict()
  • csle_collector.ossec_ids_manager.dao.ossec_ids_alert_counters module
    • OSSECIdsAlertCounters
      • OSSECIdsAlertCounters.add()
      • OSSECIdsAlertCounters.copy()
      • OSSECIdsAlertCounters.count()
      • OSSECIdsAlertCounters.from_dict()
      • OSSECIdsAlertCounters.from_grpc_object()
      • OSSECIdsAlertCounters.from_json_file()
      • OSSECIdsAlertCounters.from_kafka_record()
      • OSSECIdsAlertCounters.get_deltas()
      • OSSECIdsAlertCounters.num_attributes()
      • OSSECIdsAlertCounters.schema()
      • OSSECIdsAlertCounters.to_dict()
      • OSSECIdsAlertCounters.to_grpc_object()
      • OSSECIdsAlertCounters.to_kafka_record()
      • OSSECIdsAlertCounters.update_with_kafka_record()
  • Module contents
• csle_collector.ossec_ids_manager.threads package
  • Submodules
  • csle_collector.ossec_ids_manager.threads.ossec_ids_monitor_thread module
    • OSSecIdsMonitorThread
      • OSSecIdsMonitorThread.run()
  • Module contents

Submodules

csle_collector.ossec_ids_manager.ossec_ids_manager module

class csle_collector.ossec_ids_manager.ossec_ids_manager.OSSECIdsManagerServicer

Bases: OSSECIdsManagerServicer

gRPC server for collecting OSSEC IDS statistics.

getOSSECIdsAlerts(request: GetOSSECIdsAlertsMsg, context: ServicerContext) → OSSECIdsLogDTO

Gets the statistics of the OSSEC IDS log from a given timestamp

Parameters

• request – the gRPC request

• context – the gRPC context

Returns

a DTO with IDS statistics

getOSSECIdsMonitorStatus(request: GetOSSECIdsMonitorStatusMsg, context: ServicerContext) → OSSECIdsMonitorDTO

Gets the status of the OSSEC IDS Monitor thread

Parameters

• request – the gRPC request

• context – the gRPC context

Returns

a DTO with the status of the IDS monitor

startOSSECIds(request: StartOSSECIdsMsg, context: ServicerContext) → OSSECIdsMonitorDTO

Starts the OSSEC IDS

Parameters

• request – the gRPC request

• context – the gRPC context

Returns

a DTO with the status of the IDS and its monitor thread

startOSSECIdsMonitor(request: StartOSSECIdsMonitorMsg, context: ServicerContext) → OSSECIdsMonitorDTO

Starts the OSSEC IDS monitor thread

Parameters

• request – the gRPC request

• context – the gRPC context

Returns

a DTO with the status of the IDS monitor thread

stopOSSECIds(request: StartOSSECIdsMsg, context: ServicerContext) → OSSECIdsMonitorDTO

Stops the OSSEC IDS

Parameters

• request – the gRPC request

• context – the gRPC context

Returns

a DTO with the status of the IDS and its monitor thread

stopOSSECIdsMonitor(request: StartOSSECIdsMonitorMsg, context: ServicerContext) → OSSECIdsMonitorDTO

Stops the OSSEC IDS monitor thread if it is running

Parameters

• request – the gRPC request

• context – the gRPC context

Returns

a DTO with the status of the IDS monitor thread

csle_collector.ossec_ids_manager.ossec_ids_manager.serve(port: int = 50047, log_dir: str = '/', max_workers: int = 10, log_file_name: str = 'ossec_ids_manager.log') → None

Starts the gRPC server for managing clients

Parameters

• port – the port that the server will listen to

• log_dir – the directory to write the log file

• log_file_name – the file name of the log

• max_workers – the maximum number of GRPC workers

Returns

None

csle_collector.ossec_ids_manager.ossec_ids_manager_pb2 module

Generated protocol buffer code.

csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc module

Client and server classes corresponding to protobuf-defined services.

class csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManager

Bases: object

Interface exported by the server

static getOSSECIdsAlerts(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)

static getOSSECIdsMonitorStatus(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)

static startOSSECIds(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)

static startOSSECIdsMonitor(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)

static stopOSSECIds(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)

static stopOSSECIdsMonitor(request, target, options=(), channel_credentials=None, call_credentials=None, insecure=False, compression=None, wait_for_ready=None, timeout=None, metadata=None)

class csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerServicer

Bases: object

Interface exported by the server

getOSSECIdsAlerts(request, context)

Missing associated documentation comment in .proto file.

getOSSECIdsMonitorStatus(request, context)

Missing associated documentation comment in .proto file.

startOSSECIds(request, context)

Missing associated documentation comment in .proto file.

startOSSECIdsMonitor(request, context)

Missing associated documentation comment in .proto file.

stopOSSECIds(request, context)

Missing associated documentation comment in .proto file.

stopOSSECIdsMonitor(request, context)

Missing associated documentation comment in .proto file.

class csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.OSSECIdsManagerStub(channel)

Bases: object

Interface exported by the server

csle_collector.ossec_ids_manager.ossec_ids_manager_pb2_grpc.add_OSSECIdsManagerServicer_to_server(servicer, server)

csle_collector.ossec_ids_manager.ossec_ids_manager_util module

class csle_collector.ossec_ids_manager.ossec_ids_manager_util.OSSecManagerUtil

Bases: object

Class with utility functions related to the OSSEC IDS Manager

static check_ossec_ids_alerts() → List[OSSECIDSAlert]

Reads alerts from the OSSEC IDS alerts log

Returns

a list of alerts

static ossec_ids_log_dto_empty() → OSSECIdsLogDTO

Returns

an empty OSSECIdsLogDTO

static ossec_ids_log_dto_from_dict(d: Dict[str, Any]) → OSSECIdsLogDTO

Converts a dict representation of a OSSECIDSLogDTO to a DTO

Parameters

d – the dict to convert

Returns

the converted DTO

static ossec_ids_log_dto_to_dict(ossec_ids_log_dto: OSSECIdsLogDTO) → Dict[str, Any]

Converts a OSSECIdsLogDTO to a dict

Parameters

ossec_ids_log_dto – the dto to convert

Returns

a dict representation of the DTO

static ossec_ids_monitor_dto_empty() → OSSECIdsMonitorDTO

Returns

An empty OSSECIdsMonitorDTO

static ossec_ids_monitor_dto_from_dict(d: Dict[str, Any]) → OSSECIdsMonitorDTO

Converts a dict representation of a OSSECIDSMonitorDTO to a DTO

Parameters

d – the dict to convert

Returns

the converted DTO

static ossec_ids_monitor_dto_to_dict(ossec_ids_monitor_dto: OSSECIdsMonitorDTO) → Dict[str, Any]

Converts a OSSECIdsMonitorDTO to a dict

Parameters

ossec_ids_monitor_dto – the dto to convert

Returns

a dict representation of the DTO

static read_ossec_ids_data(episode_last_alert_ts: float) → OSSECIdsAlertCounters

Measures metrics from the OSSEC ids

Parameters

• env_config – environment configuration

• episode_last_alert_ts – timestamp when the episode started

Returns

ids statistics

csle_collector.ossec_ids_manager.query_ossec_ids_manager module

csle_collector.ossec_ids_manager.query_ossec_ids_manager.get_ossec_ids_alerts(stub: OSSECIdsManagerStub, timestamp: float, log_file_path: str, timeout=60) → OSSECIdsLogDTO

Queries the IDS manager for the data of the IDS log from a given time-step

Parameters

• stub – the stub to send the remote gRPC to the server

• timestamp – the timtestamp to parse the log from

• log_file_path – path to the IDS log file to read

• timeout – the GRPC timeout (seconds)

Returns

an IdsLogDTO with data of the IDS log

csle_collector.ossec_ids_manager.query_ossec_ids_manager.get_ossec_ids_monitor_status(stub: OSSECIdsManagerStub, timeout=60) → OSSECIdsMonitorDTO

Queries the IDS manager for the status of the IDS monitor thread

Parameters

stub – the stub to send the remote gRPC to the server

Returns

an IdsMonitorDTO describing the status of the IDS monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.start_ossec_ids(stub: OSSECIdsManagerStub, timeout=60) → OSSECIdsMonitorDTO

Sends a request to the OSSEC IDS manager to start the IDS

Parameters

• stub – the stub to send the remote gRPC to the server

• timeout – the GRPC timeout (seconds)

Returns

an OSSECIdsMonitorDTO describing the status of the IDS and its monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.start_ossec_ids_monitor(stub: OSSECIdsManagerStub, kafka_ip: str, kafka_port: int, log_file_path: str, time_step_len_seconds: int, timeout=60) → OSSECIdsMonitorDTO

Sends a request to the IDS manager to start the IDS monitor thread

Parameters

• kafka_ip – the ip of the Kafka server

• kafka_port – the port of the Kafka server

• log_file_path – the path top the IDS log

• time_step_len_seconds – the length of one time-step

• stub – the stub to send the remote gRPC to the server

• timeout – the GRPC timeout (seconds)

Returns

an IdsMonitorDTO describing the status of the IDS monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.stop_ossec_ids(stub: OSSECIdsManagerStub, timeout=60) → OSSECIdsMonitorDTO

Sends a request to the OSSEC IDS manager to stop the IDS

Parameters

• stub – the stub to send the remote gRPC to the server

• timeout – the GRPC timeout (seconds)

Returns

an OSSECIdsMonitorDTO describing the status of the IDS and its monitor thread

csle_collector.ossec_ids_manager.query_ossec_ids_manager.stop_ossec_ids_monitor(stub: OSSECIdsManagerStub, timeout=60) → OSSECIdsMonitorDTO

Sends a request to the IDS manager to stop the IDS monitor thread

Parameters

• stub – the stub to send the remote gRPC to the server

• timeout – the GRPC timeout (seconds)

Returns

an IdsMonitorDTO describing the status of the IDS monitor thread

Module contents