diff --git a/doc/Extensions/Applications.md b/doc/Extensions/Applications.md index 9a63044681..0a75927579 100644 --- a/doc/Extensions/Applications.md +++ b/doc/Extensions/Applications.md @@ -2806,6 +2806,20 @@ setup. If the default does not work, check the docs for it at suricata_stat_check](https://metacpan.org/dist/Suricata-Monitoring/view/bin/suricata_stat_check) +## Suricata Extract + +### SNMP + +1. Add the following to your snmpd config and restart. Path may have +to be adjusted depending on where `suricata_extract_submit_extend` is +installed to. +``` +extend suricata_extract /usr/local/bin/suricata_extract_submit_extend +``` + +Then just wait for the system to be rediscovered or enable it manually +for the server in question. + ## Systemd The systemd application polls systemd and scrapes systemd units' load, activation, and sub states. diff --git a/includes/html/graphs/application/suricata_extract_errors.inc.php b/includes/html/graphs/application/suricata_extract_errors.inc.php new file mode 100644 index 0000000000..39dfd02b26 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_errors.inc.php @@ -0,0 +1,11 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_ignored_host.inc.php b/includes/html/graphs/application/suricata_extract_ignored_host.inc.php new file mode 100644 index 0000000000..e829eb80a2 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_ignored_host.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_ignored_ip.inc.php b/includes/html/graphs/application/suricata_extract_ignored_ip.inc.php new file mode 100644 index 0000000000..c976e36159 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_ignored_ip.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_ignored_ip_dest.inc.php b/includes/html/graphs/application/suricata_extract_ignored_ip_dest.inc.php new file mode 100644 index 0000000000..8fd87a6603 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_ignored_ip_dest.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_ignored_ip_src.inc.php b/includes/html/graphs/application/suricata_extract_ignored_ip_src.inc.php new file mode 100644 index 0000000000..8b731da357 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_ignored_ip_src.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub.inc.php b/includes/html/graphs/application/suricata_extract_sub.inc.php new file mode 100644 index 0000000000..a98a7ce671 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub.inc.php @@ -0,0 +1,11 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_2xx.inc.php b/includes/html/graphs/application/suricata_extract_sub_2xx.inc.php new file mode 100644 index 0000000000..0573a2a701 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_2xx.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_3xx.inc.php b/includes/html/graphs/application/suricata_extract_sub_3xx.inc.php new file mode 100644 index 0000000000..49e46ee67a --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_3xx.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_4xx.inc.php b/includes/html/graphs/application/suricata_extract_sub_4xx.inc.php new file mode 100644 index 0000000000..dfd52d97b8 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_4xx.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_5xx.inc.php b/includes/html/graphs/application/suricata_extract_sub_5xx.inc.php new file mode 100644 index 0000000000..6715e0bc25 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_5xx.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_codes.inc.php b/includes/html/graphs/application/suricata_extract_sub_codes.inc.php new file mode 100644 index 0000000000..9ec8f64c06 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_codes.inc.php @@ -0,0 +1,35 @@ + '2xx', + 'sub_3xx' => '3xx', + 'sub_4xx' => '4xx', + 'sub_5xx' => '5xx', +]; + +$rrd_filename = Rrd::name($device['hostname'], ['app', 'suricata_extract', $app->app_id]); + +$rrd_list = []; +if (Rrd::checkRrdExists($rrd_filename)) { + $i = 0; + foreach ($array as $ds => $descr) { + $rrd_list[$i]['filename'] = $rrd_filename; + $rrd_list[$i]['descr'] = $descr; + $rrd_list[$i]['ds'] = $ds; + $i++; + } +} else { + echo "file missing: $rrd_filename"; +} + +require 'includes/html/graphs/generic_multi_line_exact_numbers.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_fail.inc.php b/includes/html/graphs/application/suricata_extract_sub_fail.inc.php new file mode 100644 index 0000000000..4beb050afe --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_fail.inc.php @@ -0,0 +1,11 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_sub_size.inc.php b/includes/html/graphs/application/suricata_extract_sub_size.inc.php new file mode 100644 index 0000000000..98196eaed4 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_sub_size.inc.php @@ -0,0 +1,11 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_truncated.inc.php b/includes/html/graphs/application/suricata_extract_truncated.inc.php new file mode 100644 index 0000000000..a0c6f5b8e4 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_truncated.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/graphs/application/suricata_extract_zero_sized.inc.php b/includes/html/graphs/application/suricata_extract_zero_sized.inc.php new file mode 100644 index 0000000000..309a2e3760 --- /dev/null +++ b/includes/html/graphs/application/suricata_extract_zero_sized.inc.php @@ -0,0 +1,12 @@ +app_id]); + +if (! Rrd::checkRrdExists($filename)) { + d_echo('RRD "' . $filename . '" not found'); +} + +require 'includes/html/graphs/generic_stats.inc.php'; diff --git a/includes/html/pages/apps.inc.php b/includes/html/pages/apps.inc.php index 8f9ff3ec4f..11bbf9cb27 100644 --- a/includes/html/pages/apps.inc.php +++ b/includes/html/pages/apps.inc.php @@ -460,6 +460,23 @@ $graphs['wireguard'] = [ $graphs['linux_config_files'] = [ 'number_of_confs', ]; +$graphs['suricata_extract'] = [ + 'errors', + 'ignored_host', + 'ignored_ip', + 'ignored_ip_dest', + 'ignored_ip_src', + 'sub', + 'sub_2xx', + 'sub_3xx', + 'sub_4xx', + 'sub_5xx', + 'sub_codes', + 'sub_fail', + 'truncated', + 'zero_sized', + 'sub_size', +]; $graphs['linux_softnet_stat'] = [ 'packets', 'time_squeeze', diff --git a/includes/html/pages/device/apps/suricata_extract.inc.php b/includes/html/pages/device/apps/suricata_extract.inc.php new file mode 100644 index 0000000000..7f898a0bea --- /dev/null +++ b/includes/html/pages/device/apps/suricata_extract.inc.php @@ -0,0 +1,39 @@ + 'Submission', + 'suricata_extract_ignored_host' => 'Ignored By Host', + 'suricata_extract_ignored_ip' => 'Ignored By IP', + 'suricata_extract_ignored_ip_src' => 'Ignored By IP Source', + 'suricata_extract_ignored_ip_dest' => 'Ignored By IP Destination', + 'suricata_extract_sub_fail' => 'Submission Failure', + 'suricata_extract_errors' => 'Errors', + 'suricata_extract_truncated' => 'File Truncated', + 'suricata_extract_zero_sized' => 'File Zero Sized', + 'suricata_extract_sub_size' => 'Total Size Of Submissions', + 'suricata_extract_sub_codes' => 'HTTP Submission Result Codes', + 'suricata_extract_sub_2xx' => 'HTTP Submission Result Code, 2xx', + 'suricata_extract_sub_3xx' => 'HTTP Submission Result Code, 3xx', + 'suricata_extract_sub_4xx' => 'HTTP Submission Result Code, 4xx', + 'suricata_extract_sub_5xx' => 'HTTP Submission Result Code, 5xx', +]; + +foreach ($graphs as $key => $text) { + $graph_type = $key; + $graph_array['height'] = '100'; + $graph_array['width'] = '215'; + $graph_array['to'] = \LibreNMS\Config::get('time.now'); + $graph_array['id'] = $app['app_id']; + $graph_array['type'] = 'application_' . $key; + + echo '