CODEWITHSUNDEEP
pythonparsingloggingalertssnort
MPythonLearner
MPythonLearner

Reputation: 76

Reading/Parsing Snort Alert File Using Python

What is the best way of setting parts of a text file (snort alert) into separate variables?

e.g. "Snort Log Output"

08/17-11:41:07.350700  [**] [1:1000011:0] [*] [Priority: 0] {TCP} 192.168.0.1:24586 -> 192.168.0.8:53804

I need to set:

08/17-11:41:07.350700
192.168.0.1:24586
192.168.0.8:53804

to separate variables.

It is not essential, but I would like the possibility of reading/setting multiple alerts from the same file.

But first I would like to set only one alert.

Upvotes: 1

Views: 3278

Answers (2)

user3785350
user3785350

Reputation:

A variant on the theme.

#Python 2.7.3

snort = '08/17-11:41:07.350700 [**] [1:1000011:0] [*] [Priority: 0] {TCP} 192.168.0.1:24586 -> 192.168.0.8:53804'

(dt,x,x,x,x,x,x,ip1,x,ip2) = snort.split()

print (dt,ip1,ip2)
('08/17-11:41:07.350700', '192.168.0.1:24586', '192.168.0.8:53804')

Upvotes: 1

Anton
Anton

Reputation: 4611

Parsing strings is often done using regular expressions. I recommend reading the re module documentation.

But in your case you could get away with the split() string method:

>>> s='08/17-11:41:07.350700 [] [1:1000011:0] [] [Priority: 0] {TCP} 192.168.0.1:24586 -> 192.168.0.8:53804'
>>> rec = s.split()
>>> rec
['08/17-11:41:07.350700', '[]', '[1:1000011:0]', '[]', '[Priority:', '0]', '{TCP}', '192.168.0.1:24586', '->', '192.168.0.8:53804']
>>> ts = rec[0]
>>> src = rec[6]
>>> dst = rec[7]

Upvotes: 3

Related Questions