本文讲的是
公有云厂商自建威胁情报系统，
Q:公有云厂商为什么要建立威胁情报系统？威胁情报的价值在哪里？我们不做会有什么损失？威胁情报交换能给我们带来什么附加价值？
#!/usr/bin/env python
#coding=utf-8
import traceback
from elasticsearch import Elasticsearch
import sys
import json
import datetime,time
import psycopg2
connC = psycopg2.connect(database="postgres", user="xxx", password="xxx", host="127.0.0.1",port="5432")
conn1 = psycopg2.connect(database="postgres", user="xxx", password="xxx", host="127.0.0.1",port="5432")
def GetNum():
es = Elasticsearch('x.x.x.x')
data = es.search(index=index_day, body={"query": {"match_all": {}}},size=1)
return data["hits"]["total"]
def Getidslog():
es = Elasticsearch('x.x.x.x')
tmp_str = datetime.datetime.now().strftime('%Y.%m.%d')
index_day = 'logstash-' + tmp_str
es.indices.put_settings(
{"index": {
"max_result_window": 500000
}})
num = GetNum()
data = es.search(index=index_day, body={"query": {"match_all": {}}}, size=num)
datalen=len(data["hits"]["hits"])
tableName = "%s_%s" % ("idslog", time.strftime("%Y%m%d"))
cur1 = conn1.cursor()
try:
for c in xrange(0,datalen):
# print c
if data["hits"]["hits"][c]:
m_ctime=data["hits"]["hits"][c]["_source"]["@timestamp"]
m_src_ip=data["hits"]["hits"][c]["_source"]["src_ip"]
m_category=data["hits"]["hits"][c]["_source"]["alert"]["category"]
m_signature=data["hits"]["hits"][c]["_source"]["alert"]["signature"]
sql = "INSERT INTO %s (ctime,src_ip, category,signature) VALUES ('%s','%s','%s','%s')"
sqlCmd = sql % (tableName, m_ctime, m_src_ip, m_category, m_signature)
print sqlCmd
cur1.execute(sqlCmd)
conn1.commit()
except Exception,e:
traceback.print_exc()
def CreateTable():
curC = connC.cursor()
sqlCreate = "create table if not exists %s (
ctime TEXT,
src_ip TEXT,
category TEXT,
signature TEXT
)"
tableName = "%s_%s"%("idslog", time.strftime("%Y%m%d"))
sqlCmd = sqlCreate%tableName
curC.execute(sqlCmd)
curC.close()
connC.commit()
if __name__ == '__main__':
CreateTable()
Getidslog()
url(r'^api/outxxx/id$', outputAPI.as_view()),//获取某个IP对应的威胁情报，（只提供必要的情报，内部数据需要脱敏）
url(r'^api/outxxx/IPlist$', outputIPlistAPI.as_view()), //获得所有ip列表
class outputAPI(APIView):
def get(self, request, format=None):
m_src_ip = request.GET.get("ip") //安全机制已屏蔽
print m_src_ip
tableName ='idslog_20170814'
conn1 = psycopg2.connect(database="postgres", user="xxx", password="xxx", host="127.0.0.1",
port="5432")
cur1 = conn1.cursor()
SQL1="select * from %s WHERE src_ip=%s" %(tableName,m_src_ip)
cur1.execute(SQL1)
rows = cur1.fetchall()
list =[]
for row in rows:
m = {"ctime": row[0], "src_ip": row[1],"category":row[2],"signature":row[3]}
list.append(m)
b=json.dumps(list)
return HttpResponse(b)
class outputIPlistAPI(APIView):
def get(self, request, format=None):
tableName = 'idslog_20170814'
conn1 = psycopg2.connect(database="postgres", user="xxx", password="xxx", host="127.0.0.1",
port="5432")
cur1 = conn1.cursor()
SQL1 = "select DISTINCT(src_ip) from {} ".format(tableName)
cur1.execute(SQL1)
rows = cur1.fetchall()
list = []
for row in rows:
m = {"src_ip": row[0]}
list.append(m)
b = json.dumps(list)
return HttpResponse(b)
原文发布时间为：2017年8月23日
本文作者：bt0sea
本文来自云栖社区合作伙伴嘶吼，了解相关信息可以关注嘶吼网站。
