最近业务中使用了一个入侵检测系统,其前端使用flash实现,查询和导出数据功能非常的不友好。因此,我写一个脚本来实现报警数据的导出和过滤,提高分析的效率。
环境
- windows7 x64
- vscode
- pandas,requests
- python2.7
代码
#-*- coding:utf-8 -*-
import requests
from requests.packages import urllib3
import time,csv
import pandas as pd
urllib3.disable_warnings()
#全局变量
session_id=''
s = requests.Session()
#需要防护的目标地址
targets = [
'x.x.x.x',
]
#合法的安全测试地址
exclude_ips=[
'y.y.y.y',
]
#设备的IP地址
server_ip = "xx.xx.xx.xx"
#获取表
def get_table(table_name):
global session_id,s,server_ip
#cookies
cookies = {"JSESSIONID":session_id}
page_num=0 #page页码
total_page = 0 #页码总数 从0开始算
page_size = 1000 #单页返回的记录数
table_data = [] #用来保存表中的数据
while page_num <= total_page: #基当前的页码小于页码总数
#请求数据的url
url = 'https://%s/query/query%s.action?currentTime=%d' % (server_ip,table_name,int(time.time()))
#提交的参数
data = {"pageSize":page_size,
"endDate":"2020-02-18 14:00:00",
"beginDate":"2020-02-18 00:00:00",
"sessionID":session_id,
"queryType":"0",
"userId":"1",
"pageNumber":page_num}
#请求表格的数据
r = s.post(url,data=data,cookies=cookies,verify=False)
if r.status_code == 200:
if page_num == 0:#若是第一页
#计算总页码
total_page = int(r.json()['total'])/page_size
print('total_page',total_page)
#将数据存储table_data
table_data += r.json()['data']
#页码加1
page_num += 1
#如果表内数据不为空
if table_data:
#使用pandas处理数据
df = pd.DataFrame(table_data)
#过滤函数
filter_condition = lambda x: (x['saddr'] in targets or x['daddr'] in targets) and x['saddr'] not in exclude_ips and x['daddr'] not in exclude_ips
df = df[df.apply(filter_condition,axis=1)]
#导出为csv文件
df.to_csv('%s.csv'% table_name,encoding='utf-8')
def main():
global session_id,s,server_ip
#headers
headers = {
'Host': server_ip,
'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0',
'Accept': '*/*',
'Accept-Language': 'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
'Accept-Encoding': 'gzip, deflate, br',
'Origin': 'https://%s' % server_ip,
'Connection': 'keep-alive',
'Referer': 'https://%s/index.swf/[[DYNAMIC]]/4' % server_ip,
'Content-type': 'application/x-www-form-urlencoded'
}
#提交的认证信息
data = {"username":"admin","password":"****","isNeed":False}
#登陆
url = 'https://%s/login/login.action?currentTime=%d' % (server_ip,int(time.time()))
r = s.post(url,headers = headers,data=data,verify=False)
if r.status_code == 200:
#获取会话id
session_id = r.json()['sessionID']
print session_id
#系统中表的名字
table_names = [
'MaliciousCodeInfectionEvent',
'WebEvent',
'CommunicationBehaviorEvent',
'SpreadMaliciousCodeEvent',
'MaliciousUrlAccessEvent',
'AttackAttemptEvent',
'OtherEvent'
]
for table_name in table_names:
print table_name
#获取表的内容
get_table(table_name)
main()
网友评论