Skip to content

Commit 0e6999d

Browse files
kishenpatel-97kishenpatel-97
committed
added files
1 parent 35f2629 commit 0e6999d

File tree

5 files changed

+400
-0
lines changed

5 files changed

+400
-0
lines changed

‎src/Block_IP.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
from fastapi import FastAPI, Request
2+
import json
3+
import subprocess
4+
import os
5+
import re
6+
7+
app = FastAPI()
8+
9+
EXCLUDED_IPS = ["1.1.1.3"] # List of IPs to exclude from blocking
10+
11+
def block_ip(ip):
12+
""" Block the given IP using iptables """
13+
if ip in EXCLUDED_IPS:
14+
print(f"[INFO] Skipping blocking for excluded IP {ip}")
15+
return
16+
17+
print(f"[INFO] Attempting to block IP {ip}...")
18+
19+
# Block the IP using iptables
20+
os.system(f"sudo iptables -A INPUT -s {ip} -j DROP")
21+
os.system(f"sudo iptables -A OUTPUT -d {ip} -j DROP")
22+
print(f"[INFO] IP {ip} blocked permanently.")
23+
24+
def extract_ip(text_value):
25+
""" Extracts IP addresses that come after the words 'to' or 'from' in the text_value field """
26+
# Regular expression to find IPs after "to" or "from"
27+
match = re.findall(r"\b(?:to|from)\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b", text_value, re.IGNORECASE)
28+
29+
if match:
30+
# Return the first IP address found after 'to' or 'from'
31+
print(f"[DEBUG] Extracted IP: {match[0]}")
32+
return match[0]
33+
34+
print("[DEBUG] No IP found after 'to' or 'from' in message!")
35+
return None
36+
37+
@app.post("/")
38+
async def receive_alerts(request: Request):
39+
""" API endpoint to receive alerts and process them """
40+
try:
41+
data = await request.json() # Parse the JSON data
42+
43+
if data.get("message_type") == "ASYNC":
44+
print("[INFO] Processing ASYNC message...")
45+
46+
for alert in data.get("feed", []):
47+
msg_type = alert.get("message_type", "")
48+
text_value = alert.get("text_value", "")
49+
50+
if "MAIAlert" in msg_type:
51+
print(f"[DEBUG] Received Alert: {text_value}")
52+
53+
# Extract IP address from the alert's text_value
54+
ip = extract_ip(text_value)
55+
if ip:
56+
block_ip(ip)
57+
else:
58+
print("[WARNING] No valid IP found in alert.")
59+
60+
return {"status": "success", "message": "ASYNC alert processed"}
61+
62+
except json.JSONDecodeError:
63+
print("[ERROR] Failed to decode JSON message!")
64+
return {"status": "error", "message": "Invalid JSON"}
65+
66+
if __name__ == "__main__":
67+
import uvicorn
68+
uvicorn.run(app, host="0.0.0.0", port=8000)

‎src/Block_Port.py‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
from fastapi import FastAPI, Request
2+
import json
3+
import subprocess
4+
import os
5+
import re
6+
7+
app = FastAPI()
8+
9+
def block_port(port):
10+
""" Block the port using iptables and kill any process using it """
11+
12+
print(f"[INFO] Attempting to block port {port}...")
13+
14+
# Find process using the port
15+
result = subprocess.run(f"sudo lsof -i :{port} -t", shell=True, capture_output=True, text=True)
16+
pids = result.stdout.strip().split("\n")
17+
18+
# Kill all processes using the port
19+
for pid in pids:
20+
if pid.isdigit():
21+
print(f"[INFO] Killing process {pid} using port {port}...")
22+
os.system(f"sudo kill -9 {pid}")
23+
24+
# Block the port using iptables
25+
os.system(f"sudo iptables -A INPUT -p tcp --dport {port} -j DROP")
26+
os.system(f"sudo iptables -A OUTPUT -p tcp --sport {port} -j DROP")
27+
print(f"[INFO] Port {port} blocked.")
28+
29+
def extract_port(text_value):
30+
""" Extracts port number from 'text_value' field """
31+
match = re.search(r"\b(\d{2,5})\b", text_value)
32+
if match:
33+
port = int(match.group(1))
34+
print(f"[DEBUG] Extracted port: {port}")
35+
return port
36+
37+
print("[DEBUG] No port found in message!")
38+
return None
39+
40+
@app.post("/")
41+
async def receive_alerts(request: Request):
42+
""" API endpoint to receive alerts and process them """
43+
try:
44+
data = await request.json()
45+
46+
if data.get("message_type") == "ASYNC":
47+
print("[INFO] Processing ASYNC message...")
48+
49+
for alert in data.get("feed", []):
50+
msg_type = alert.get("message_type", "")
51+
text_value = alert.get("text_value", "")
52+
53+
if "A new listening port" in text_value:
54+
print(text_value)
55+
port = extract_port(text_value)
56+
if port:
57+
block_port(port)
58+
else:
59+
print("[WARNING] No valid port found in alert.")
60+
61+
return {"status": "success", "message": "ASYNC alert processed"}
62+
63+
except json.JSONDecodeError:
64+
print("[ERROR] Failed to decode JSON message!")
65+
return {"status": "error", "message": "Invalid JSON"}
66+
67+
if __name__ == "__main__":
68+
import uvicorn
69+
uvicorn.run(app, host="0.0.0.0", port=8000)

‎src/Filtering_Severity.py‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
from fastapi import FastAPI, Request
2+
import json
3+
4+
# List of severities to filter
5+
SEVERITIES_TO_FILTER = ["High", "Critical"] # You can easily change these values
6+
7+
app = FastAPI()
8+
9+
def process_message(message):
10+
"""Process and filter MAIAlert messages with specified severity levels."""
11+
try:
12+
data = json.loads(message)
13+
for alert in data.get("feed", []):
14+
if alert.get("message_type") == "MAIAlert" and alert.get("severity") in SEVERITIES_TO_FILTER:
15+
print(f"\n#High/Critical Alert Detected!")
16+
print(f"Time: {alert['edge_datetime']}")
17+
print(f"Device: {alert['device_id']}")
18+
print(f"Alert: {alert['sensor_name']}")
19+
print(f"Severity: {alert['severity']}")
20+
print(f"Details: {alert['text_value']}\n")
21+
except json.JSONDecodeError:
22+
print("? Error decoding JSON")
23+
24+
@app.post("/")
25+
async def receive_alerts(request: Request):
26+
"""API endpoint to receive alerts and process them."""
27+
try:
28+
data = await request.json() # Parse the JSON data
29+
30+
if data.get("message_type") == "ASYNC":
31+
print("[INFO] Processing ASYNC message...")
32+
33+
for alert in data.get("feed", []):
34+
msg_type = alert.get("message_type", "")
35+
if "MAIAlert" in msg_type:
36+
process_message(json.dumps(data)) # Process the received message
37+
return {"status": "success", "message": "Alert processed"}
38+
39+
except json.JSONDecodeError:
40+
print("[ERROR] Failed to decode JSON message!")
41+
return {"status": "error", "message": "Invalid JSON"}
42+
43+
if __name__ == "__main__":
44+
import uvicorn
45+
uvicorn.run(app, host="0.0.0.0", port=8000)

‎src/Merged-Scripts.py‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
from fastapi import FastAPI, Request
2+
import json
3+
import subprocess
4+
import os
5+
import re
6+
7+
8+
SEVERITIES_TO_FILTER = ["High", "Critical"] # List of severities to filter
9+
EXCLUDED_IPS = ["1.1.1.3"] # List of IPs to exclude from blocking
10+
EXCLUDED_PROCESSES = ["sh", "bash", "python3"] # Processes to exclude from termination
11+
12+
app = FastAPI()
13+
14+
def process_high_severity_alert(alert):
15+
"""Process and filter MAIAlert messages with specified severity levels."""
16+
if alert.get("message_type") == "MAIAlert" and alert.get("severity") in SEVERITIES_TO_FILTER:
17+
print(f"\n#High/Critical Alert Detected!")
18+
print(f"Time: {alert['edge_datetime']}")
19+
print(f"Device: {alert['device_id']}")
20+
print(f"Alert: {alert['sensor_name']}")
21+
print(f"Severity: {alert['severity']}")
22+
print(f"Details: {alert['text_value']}\n")
23+
24+
def extract_ip(text_value):
25+
""" Extracts IP addresses that come after the words 'to' or 'from' in the text_value field """
26+
# Regular expression to find IPs after "to" or "from"
27+
match = re.findall(r"\b(?:to|from)\s+(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b", text_value, re.IGNORECASE)
28+
29+
if match:
30+
# Return the first IP address found after 'to' or 'from'
31+
print(f"[DEBUG] Extracted IP: {match[0]}")
32+
return match[0]
33+
34+
print("[DEBUG] No IP found after 'to' or 'from' in message!")
35+
return None
36+
37+
def block_ip(ip):
38+
""" Block the given IP using iptables """
39+
if ip in EXCLUDED_IPS:
40+
print(f"[INFO] Skipping blocking for excluded IP {ip}")
41+
return
42+
43+
print(f"[INFO] Attempting to block IP {ip}...")
44+
45+
# Block the IP using iptables
46+
os.system(f"sudo iptables -A INPUT -s {ip} -j DROP")
47+
os.system(f"sudo iptables -A OUTPUT -d {ip} -j DROP")
48+
print(f"[INFO] IP {ip} blocked permanently.")
49+
50+
def extract_port(text_value):
51+
""" Extracts port number from 'text_value' field """
52+
match = re.search(r"\b(\d{2,5})\b", text_value)
53+
if match:
54+
port = int(match.group(1))
55+
print(f"[DEBUG] Extracted port: {port}")
56+
return port
57+
58+
print("[DEBUG] No port found in message!")
59+
return None
60+
61+
def block_port(port):
62+
""" Block the port using iptables and kill any process using it """
63+
64+
print(f"[INFO] Attempting to block port {port}...")
65+
66+
# Find process using the port
67+
result = subprocess.run(f"sudo lsof -i :{port} -t", shell=True, capture_output=True, text=True)
68+
pids = result.stdout.strip().split("\n")
69+
70+
# Kill all processes using the port
71+
for pid in pids:
72+
if pid.isdigit():
73+
print(f"[INFO] Killing process {pid} using port {port}...")
74+
os.system(f"sudo kill -9 {pid}")
75+
76+
# Block the port using iptables
77+
os.system(f"sudo iptables -A INPUT -p tcp --dport {port} -j DROP")
78+
os.system(f"sudo iptables -A OUTPUT -p tcp --sport {port} -j DROP")
79+
print(f"[INFO] Port {port} blocked.")
80+
81+
def extract_process_name(text_value):
82+
""" Extracts the process name from the alert """
83+
if "|" in text_value:
84+
process_name = text_value.split("|")[-1].strip()
85+
print(f"[DEBUG] Extracted process name: {process_name}")
86+
return process_name
87+
return text_value # Return full string if no '|' is found
88+
89+
def terminate_process(process_name):
90+
""" Terminate the process by its name unless it's excluded """
91+
if process_name in EXCLUDED_PROCESSES:
92+
print(f"[INFO] Skipping termination for excluded process: {process_name}")
93+
return
94+
95+
print(f"[INFO] Attempting to terminate process: {process_name}...")
96+
result = subprocess.run(f"pgrep -f {process_name}", shell=True, capture_output=True, text=True)
97+
pids = result.stdout.strip().split("\n")
98+
99+
for pid in pids:
100+
if pid.isdigit():
101+
print(f"[INFO] Terminating process {pid} ({process_name})...")
102+
os.system(f"sudo kill -9 {pid}")
103+
104+
@app.post("/")
105+
async def receive_alerts(request: Request):
106+
"""Unified API endpoint to receive and process all types of alerts."""
107+
try:
108+
data = await request.json() # Parse the JSON data
109+
110+
if data.get("message_type") == "ASYNC":
111+
print("[INFO] Processing ASYNC message...")
112+
113+
for alert in data.get("feed", []):
114+
# Process high severity alerts
115+
process_high_severity_alert(alert)
116+
117+
msg_type = alert.get("message_type", "")
118+
text_value = alert.get("text_value", "")
119+
120+
# Process IP blocking alerts
121+
if "MAIAlert" in msg_type:
122+
# Process for IP blocking
123+
print(f"[DEBUG] Received Alert: {text_value}")
124+
ip = extract_ip(text_value)
125+
if ip:
126+
block_ip(ip)
127+
128+
# Process port blocking alerts
129+
if "A new listening port" in text_value:
130+
print(text_value)
131+
port = extract_port(text_value)
132+
if port:
133+
block_port(port)
134+
135+
# Process suspicious process alerts
136+
if "Abnormal process detected" in text_value:
137+
print(text_value)
138+
process_name = extract_process_name(text_value)
139+
if process_name and process_name not in EXCLUDED_PROCESSES:
140+
terminate_process(process_name)
141+
elif process_name in EXCLUDED_PROCESSES:
142+
print(f"[INFO] Skipping remediation for excluded process: {process_name}")
143+
144+
return {"status": "success", "message": "Alert processed"}
145+
146+
except json.JSONDecodeError:
147+
print("[ERROR] Failed to decode JSON message!")
148+
return {"status": "error", "message": "Invalid JSON"}
149+
150+
if __name__ == "__main__":
151+
import uvicorn
152+
uvicorn.run(app, host="0.0.0.0", port=8000)

0 commit comments

Comments
 (0)