|
|||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectcom.martealert.martealertTable
com.martealert.martealertFirstLevel
This public class makes an object with a Vector for column names and a Vector of Vector for data. Basic structure of a preludeGroupedAlert object has following columns:
N | Classification | Source_Addr | Source_Port | Protocol | Target_Addr | Target_Port | Sensor | First_Time_Sign | Last_Time_Sign |
Field Summary | |
protected int |
max
|
Fields inherited from class com.martealert.martealertTable |
_, ALIASVAR, columnNames, data, DEFAULT, GROUPBY, IDENT, INDEX, INDEXSEARCH, NAMEDVAR, RELATION, SELECT, TX, UNNAMEDVAR, VAR |
Fields inherited from interface com.martealert.martealertConstants |
AMBIGUOUS_FIELDS, ANALYZER, CLASSIFICATION, COMPLETION, FTS, FTSTZ, HOUR_IN_MILLIS, INTERVAL, IPADDRS, LASTJOIN, LTS, LTSTZ, MAXMSGID, MAXSEVERITY, MFTS, MLTS, MSGID, MSOURCEPORT, NALERTS, NOTNULL_FIELDS, NULL_FIELDS, NXCLASSIFICATION, ORDER_BY_ALERTS, ORDER_BY_MAXTIME, ORDER_BY_TIME, PRELUDE_TABLES, PROTOCOL, SENSOR, SEVERITY, SEVERITY_COMPLETION, SOURCE, SOURCEIP, SOURCEPORT, SOURCEUID, TARGET, TARGETIP, TARGETPORT, TARGETPORT_PROTOCOL, TARGETUID, TERMINAL, TIME, TIMETZ, TLAST, TOP, TOTALTIME |
Fields inherited from interface com.martealert.martealertRealTimeInterface |
REAL_TIME_CLASSIFICATION, REAL_TIME_COMPLETION, REAL_TIME_MSGID, REAL_TIME_SEVERITY, REAL_TIME_SOURCEIP, REAL_TIME_TARGETIP, REAL_TIME_TIME |
Constructor Summary | |
|
martealertFirstLevel()
Creates a new instance of preludeGroupedAlert. |
protected |
martealertFirstLevel(char separator)
Creates a new instance of preludeGroupedAlert with specified separator. |
Method Summary | |
void |
clear()
Clear this values. |
protected java.lang.String |
getClassification(martealertTable pt)
Get event types from a martealertTable |
java.util.Vector |
getFirstLevelRow(java.sql.Connection con,
martealertHashFilter filter)
Get a martealertFirstLevel row from a filter with a source ip and a target ip obtained
from initialization of first level or invokation of getPairAddress |
protected int |
getFTSColumn()
Get number of FTS column. |
int[] |
getIgnoredColumnsPdf()
Get column numbers of a martealertTable to be ignored for generating pdf report. |
protected java.lang.String |
getIP(int col,
martealertTable pt)
Get ip address from column col of pt table. |
protected java.lang.String |
getIpAddress(java.sql.Connection con,
int ident,
char c)
Calculate IP Address from a sql identifier. |
protected java.lang.String |
getIpAddress(java.sql.Connection con,
java.lang.String ident,
char c)
Calculate IP Address from a sql identifier. |
int[] |
getIpColumns()
Get IP-columns numbers in an array of int. |
protected int |
getLTSColumn()
Get number of LTS column. |
int[] |
getMultilineColumns()
Get array with number of columns which rows can store multiline values (sub-rows). |
java.util.Vector |
getNextPairAddress(java.sql.Connection con,
martealertHashFilter filter)
Get next pair address in a vector with the same format that getPairAddressTable, but obtaining rows one by one |
martealertTable |
getPairAddressTable(java.sql.Connection con,
martealertHashFilter filter)
Get a preludeTable with source and target address info needed for alertRow count in getAlertsTable. |
protected static java.lang.String |
getPort(int st,
martealertTable ptserv)
Get source or target port from a martealertTable. |
protected java.lang.String |
getProbe(martealertTable pt)
Get probe address or resolved name from a martealertFirstLevel table |
protected static java.lang.String |
getProtocol(martealertTable ptserv)
Get protocol from martealertTable. |
protected martealertTable |
getRowInfoTable(java.sql.Connection con,
martealertHashFilter filter)
Get a martealertTable with info for one metarow. |
protected java.lang.String |
getSensorInfo(martealertTable pt)
Return a String with all sensors separated by separator defined in constructor. |
int |
getSeverityColumn()
Get column number which has maximum severity for each martealertFirstLevel row. |
protected static java.lang.String |
getSourceInfo(java.lang.String msgid,
martealertTable ptuid,
martealertTable ptaddr)
Return source info of a alert metarow with the following format: |
protected java.lang.String |
getSqlAuxGroupBy()
|
protected java.lang.String |
getSqlAuxVars()
|
protected java.lang.String |
getSqlGroupBy()
|
protected java.lang.String |
getSqlLimit()
|
protected java.lang.String |
getSqlOrderBy()
|
protected java.lang.String |
getSqlVars()
Return a string with all variables needed for martealertFirstLevel, separated with comas except the last one |
protected java.lang.String |
getSqlWhere(martealertHashFilter filter,
java.lang.String[] fields)
|
protected static java.lang.String |
getTargetInfo(java.sql.Connection con,
java.lang.String msgid,
martealertTable ptaddr)
Get target info: address at least or address empty for localhost, and optionally alto hostname and user id. |
martealertTable |
initFirstLevel(java.sql.Connection con,
martealertHashFilter filter,
javax.swing.JProgressBar jpbar)
Initialize first level calculating pair address table and setting up progress bar. |
static void |
main(java.lang.String[] args)
Test main method for addresses class. |
protected java.lang.String |
numberOcurrences(java.util.Vector v)
Get number ocurrences for "N" field |
void |
reload(java.sql.Connection con)
Returns a table (Vector of Vector of String) with all alerts grouped by source and target addresses. |
void |
reload(java.sql.Connection con,
martealertHashFilter filter)
Returns a table (Vector of Vector of String) with all alerts grouped by source and target addresses in the specified time interval. |
void |
reload(java.sql.Connection con,
martealertHashFilter filter,
javax.swing.JProgressBar jpbar)
Returns a table (Vector of Vector of String) with all alerts grouped by source and target addresses in the specified time interval. |
void |
setColumnNames()
Set initial values to columnNames vector of a PreludeFirstLevel object. |
protected java.util.Vector |
vfields()
Compose a vector with components for joins between tables. |
Methods inherited from class com.martealert.martealertTable |
getColumn, getColumnNames, getColumnSize, getData, getPercentColumns, getPortColumns, getProtocolColumns, getRow, getRowSize, getSqlRelation, getTableVector, getValue, getValue, getValue, printTable, setColumnNames, setDataVector, setDataVector, setValue |
Methods inherited from class java.lang.Object |
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Field Detail |
protected int max
Constructor Detail |
public martealertFirstLevel()
protected martealertFirstLevel(char separator)
separator
- char to separate subrows into Classification and Sensor fields of a meta-row.Method Detail |
public void setColumnNames()
protected java.util.Vector vfields()
public void clear()
this
values.
clear
in class martealertTable
public void reload(java.sql.Connection con) throws java.sql.SQLException
con
- Connection variable to access PostgreSQL database
N | Classification | Source Addr | Source Port | Protocol | Target Addr | Target Port | Sensor | FTS | LTS |
---|---|---|---|---|---|---|---|---|---|
67 | Admin login failed | 217.160.2.10 | 1066 | tcp | 192.168.1.33 | 33654 | PAM | 2005-12-14 16:26:11.0 | 2005-12-16 11:58:06.0 |
23 | Admin login failed | localhost | 127.0.0.1 | PAM | 2005-12-14 16:26:11.0 | 2005-12-16 11:58:06.0 | |||
61 | Promiscuous mode detected | localhost | 127.0.0.1 | PAM | 2005-12-14 22:17:20.0 | 2005-12-19 20:15:03.0 | |||
88 | User authentication successful | localhost | 127.0.0.1 | PAM | 2005-12-14 16:25:23.0 | 2005-12-21 09:54:30.0 | |||
4 | User Created | localhost | 127.0.0.1 | PAM | 2005-12-15 00:04:40.0 | 2005-12-20 23:32:26.0 | |||
21 | Group Created | localhost | 127.0.0.1 | PAM | 2005-12-15 15:26:45.0 | 2005-12-20 23:32:26.0 | |||
790 | SUDO Command Executed | localhost | 127.0.0.1 | PAM | 2005-12-15 01:03:18.0 | 2005-12-21 08:47:53.0 | |||
5 | User authentication failed | localhost | 127.0.0.1 | PAM | 2005-12-14 16:23:39.0 | 2005-12-19 23:46:48.0 | |||
2 | Logfile inconsistency | n/a | prelude-lml | 2005-12-12 17:56:42.0 | 2005-12-12 17:56:42.0 |
java.sql.SQLException
- SQL syntax error invoking statement.executeQuery(String sql_query);public void reload(java.sql.Connection con, martealertHashFilter filter) throws java.sql.SQLException
reload
in class martealertTable
con
- Connection variable to access PostgreSQL database Connection variable to access PostgreSQL database Connection variable to the database.filter
- martealertHashFilter
to obtain first level table filtered.
N | Classification | Source Addr | Source Port | Protocol | Target Addr | Target Port | Sensor | FTS | LTS |
---|---|---|---|---|---|---|---|---|---|
2 | Admin login failed | 127.0.0.1 | PAM | 2005-12-14 16:26:11.0 | 2005-12-16 11:58:06.0 | ||||
2 | Admin login failed | 127.0.0.1 | PAM | 2005-12-14 16:26:11.0 | 2005-12-16 11:58:06.0 | ||||
6 | Promiscuous mode detected | 127.0.0.1 | PAM | 2005-12-14 22:17:20.0 | 2005-12-19 20:15:03.0 | ||||
88 | User authentication successful | 127.0.0.1 | PAM | 2005-12-14 16:25:23.0 | 2005-12-21 09:54:30.0 | ||||
4 | User Created | 127.0.0.1 | PAM | 2005-12-15 00:04:40.0 | 2005-12-20 23:32:26.0 | ||||
2 | Group Created | 127.0.0.1 | PAM | 2005-12-15 15:26:45.0 | 2005-12-20 23:32:26.0 | ||||
79 | SUDO Command Executed | 127.0.0.1 | PAM | 2005-12-15 01:03:18.0 | 2005-12-21 08:47:53.0 | ||||
5 | User authentication failed | 127.0.0.1 | PAM | 2005-12-14 16:23:39.0 | 2005-12-19 23:46:48.0 | ||||
1 | User login successful | 192.168.100.61 | 41595 | tcp | 127.0.0.1 | 22 | sshd | 2005-12-15 12:47:11.0 | 2005-12-15 12:47:11.0 |
1 | Admin login successful | 192.168.100.61 | 41595 | tcp | 127.0.0.1 | 22 | sshd | 2005-12-16 11:58:09.0 | 2005-12-16 11:58:09.0 |
1 | User authentication failed | elmo | 127.0.0.1 | PAM | 2005-12-16 11:58:04.0 | 2005-12-16 11:58:04.0 | |||
1 | User login successful | 192.168.100.60 | 36422 | tcp | 127.0.0.1 | 22 | sshd | 2005-12-15 09:27:01.0 | 2005-12-15 09:27:01.0 |
1 | User authentication failed | 192.168.100.72 | 127.0.0.1 | PAM | 2005-12-14 16:26:09.0 | 2005-12-14 16:26:09.0 | |||
31 | User authentication successful | 192.168.100.72 | PAM | 2005-12-12 10:19:44.0 | 2005-12-14 11:30:14.0 | ||||
2 | Promiscuous mode detected | 192.168.100.72 | PAM | 2005-12-13 13:02:30.0 | 2005-12-13 13:09:52.0 | ||||
1 | Logfile inconsistency | n/a | prelude-lml | 2005-12-12 17:56:42.0 | 2005-12-12 17:56:42.0 |
java.sql.SQLException
- SQL syntax error invoking statement.executeQuery(String sql_query);public void reload(java.sql.Connection con, martealertHashFilter filter, javax.swing.JProgressBar jpbar) throws java.sql.SQLException
con
- Connection variable to access PostgreSQL database Connection variable to access PostgreSQL database Connection variable to the database.filter
- martealertHashFilter
to obtain first level table filtered.jpbar
- JProgressBar for showing status.
N | Classification | Source Addr | Source Port | Protocol | Target Addr | Target Port | Sensor | FTS | LTS |
---|---|---|---|---|---|---|---|---|---|
2 | Admin login failed | 127.0.0.1 | PAM | 2005-12-14 16:26:11.0 | 2005-12-16 11:58:06.0 | ||||
2 | Admin login failed | 127.0.0.1 | PAM | 2005-12-14 16:26:11.0 | 2005-12-16 11:58:06.0 | ||||
6 | Promiscuous mode detected | 127.0.0.1 | PAM | 2005-12-14 22:17:20.0 | 2005-12-19 20:15:03.0 | ||||
88 | User authentication successful | 127.0.0.1 | PAM | 2005-12-14 16:25:23.0 | 2005-12-21 09:54:30.0 | ||||
4 | User Created | 127.0.0.1 | PAM | 2005-12-15 00:04:40.0 | 2005-12-20 23:32:26.0 | ||||
2 | Group Created | 127.0.0.1 | PAM | 2005-12-15 15:26:45.0 | 2005-12-20 23:32:26.0 | ||||
79 | SUDO Command Executed | 127.0.0.1 | PAM | 2005-12-15 01:03:18.0 | 2005-12-21 08:47:53.0 | ||||
5 | User authentication failed | 127.0.0.1 | PAM | 2005-12-14 16:23:39.0 | 2005-12-19 23:46:48.0 | ||||
1 | User login successful | 192.168.100.61 | 41595 | tcp | 127.0.0.1 | 22 | sshd | 2005-12-15 12:47:11.0 | 2005-12-15 12:47:11.0 |
1 | Admin login successful | 192.168.100.61 | 41595 | tcp | 127.0.0.1 | 22 | sshd | 2005-12-16 11:58:09.0 | 2005-12-16 11:58:09.0 |
1 | User authentication failed | elmo | 127.0.0.1 | PAM | 2005-12-16 11:58:04.0 | 2005-12-16 11:58:04.0 | |||
1 | User login successful | 192.168.100.60 | 36422 | tcp | 127.0.0.1 | 22 | sshd | 2005-12-15 09:27:01.0 | 2005-12-15 09:27:01.0 |
1 | User authentication failed | 192.168.100.72 | 127.0.0.1 | PAM | 2005-12-14 16:26:09.0 | 2005-12-14 16:26:09.0 | |||
31 | User authentication successful | 192.168.100.72 | PAM | 2005-12-12 10:19:44.0 | 2005-12-14 11:30:14.0 | ||||
2 | Promiscuous mode detected | 192.168.100.72 | PAM | 2005-12-13 13:02:30.0 | 2005-12-13 13:09:52.0 | ||||
1 | Logfile inconsistency | n/a | prelude-lml | 2005-12-12 17:56:42.0 | 2005-12-12 17:56:42.0 |
java.sql.SQLException
- SQL syntax error invoking statement.executeQuery(String sql_query);public martealertTable getPairAddressTable(java.sql.Connection con, martealertHashFilter filter) throws java.sql.SQLException
con
- Connection variable to access PostgreSQL database Connection variable to access PostgreSQL databasefilter
- martealertHashFilter
to be added to sql sentence in order to restrict answer. Filter syntax has to begin with "AND " clause.Source Addr | Target Addr | count | Max Time | Classification |
---|---|---|---|---|
127.0.0.1 | 181 | 2005-12-21 09:54:30.0 | User login successful | |
palocortado | 127.0.0.1 | 5 | 2005-12-19 23:46:48.0 | Promiscuous mode detected |
192.168.100.61 | 127.0.0.1 | 2 | 2005-12-16 11:58:09.0 | Admin login failed |
elmo | 127.0.0.1 | 1 | 2005-12-16 11:58:04.0 | User Creation |
192.168.100.60 | 127.0.0.1 | 1 | 2005-12-15 09:27:31.0 | SUDO Command Executed |
192.168.100.72 | 33 | 2005-12-14 11:30:14.0 | User autentication failed | |
1 | 2005-12-21 17:56:42.0 | Logfile inconsistency |
java.sql.SQLException
- SQL syntax error invoking statement.executeQuery(String sql_query);public java.util.Vector getNextPairAddress(java.sql.Connection con, martealertHashFilter filter) throws java.sql.SQLException
con
- Connection to the database.filter
- martealertHashFilter
for filter first level table values.
java.sql.SQLException
- SQL error acceeding to calculate next pair address table.public martealertTable initFirstLevel(java.sql.Connection con, martealertHashFilter filter, javax.swing.JProgressBar jpbar) throws java.sql.SQLException
con
- Connection to the database.filter
- martealertHashFilter
for filter first level table values.jpbar
- JProgressBar for represent status and how many steps left for completing martealertFirstLevel
martealertTable
with all pair address table.
java.sql.SQLException
- SQL error initializing first level.protected java.lang.String getIpAddress(java.sql.Connection con, java.lang.String ident, char c) throws java.sql.SQLException
con
- Connection variable to access the database.ident
- String with identifier to obtain IP address.c
- char protected constant to indicate SOURCE, TARGET or ANALYZER.
java.sql.SQLException
- SQL Syntax error.protected java.lang.String getIpAddress(java.sql.Connection con, int ident, char c) throws java.sql.SQLException
con
- Connection variable to access the database.ident
- int with identifier to obtain IP address.c
- char protected constant to indicate SOURCE, TARGET or ANALYZER.
java.sql.SQLException
- SQL Syntax error.public java.util.Vector getFirstLevelRow(java.sql.Connection con, martealertHashFilter filter) throws java.sql.SQLException
martealertFirstLevel
row from a filter with a source ip and a target ip obtained
from initialization of first level or invokation of getPairAddress
con
- Connection to access the database.filter
- martealertHashFilter
with pair ip addresses.
java.sql.SQLException
- SQL syntax error.protected martealertTable getRowInfoTable(java.sql.Connection con, martealertHashFilter filter) throws java.sql.SQLException
con
- Connection variable to access PostgreSQL database.filter
- martealertHashFilter
to select some specific rows.
N | NxClassification | Severity | Source Addr | Target Addr | Sensor | FTS | LTS |
---|---|---|---|---|---|---|---|
18 | User login successful | low | 192.168.100.72 | 64.101.108.73 | PAM | 2005-12-21 09:54:30.0 | |
3 | Admin login successful | medium | 64.101.108.73 | 192.168.100.72 | snort | 2005-12-19 23:46:48.0 |
java.sql.SQLException
- SQL syntax error.protected java.lang.String getSqlVars()
protected java.lang.String getSqlAuxVars()
protected java.lang.String getSqlGroupBy()
protected java.lang.String getSqlWhere(martealertHashFilter filter, java.lang.String[] fields)
protected java.lang.String getSqlLimit()
protected java.lang.String getSqlAuxGroupBy()
protected java.lang.String getSqlOrderBy()
protected static java.lang.String getSourceInfo(java.lang.String msgid, martealertTable ptuid, martealertTable ptaddr) throws java.lang.ArrayIndexOutOfBoundsException
msgid
- Message identifier, useful to get user id.ptuid
- ptaddr
-
java.lang.ArrayIndexOutOfBoundsException
- Is thrown when has been exceeded logrow vector size.protected java.lang.String getIP(int col, martealertTable pt)
col
- Column where ip address (Source or target) is.pt
- martealertTable
from is obtained ip address.
martealertFirstLevel
protected static java.lang.String getPort(int st, martealertTable ptserv)
st
- integer to choose between source and target port. S constant means source and T, target. They're protected final vars of this class.ptserv
- martealertTable which stores info about port, name port, protocol and service.
protected static java.lang.String getProtocol(martealertTable ptserv)
ptserv
- martealertTable which stores info about port, name port, protocol and service.
protected static java.lang.String getTargetInfo(java.sql.Connection con, java.lang.String msgid, martealertTable ptaddr)
con
- Connection variable to access PostgreSQL databasemsgid
- String with message identifier.ptaddr
- martealertTable with info about source and target addresses.
protected java.lang.String getSensorInfo(martealertTable pt)
separator
defined in constructor.
pt
- martealertTable
with first level.
protected java.lang.String getClassification(martealertTable pt)
pt
- martealertTable with info about event type.
protected java.lang.String getProbe(martealertTable pt)
pt
- martealertTable with info about probe.
protected java.lang.String numberOcurrences(java.util.Vector v)
v
- Vector row passed from martealertFirstLevel table.
public int[] getIpColumns()
getIpColumns
in class martealertTable
public int[] getMultilineColumns()
martealertFirstLevel
.
getMultilineColumns
in class martealertTable
public int getSeverityColumn()
getSeverityColumn
in class martealertTable
protected int getFTSColumn()
getFTSColumn
in class martealertTable
protected int getLTSColumn()
getLTSColumn
in class martealertTable
public int[] getIgnoredColumnsPdf()
getIgnoredColumnsPdf
in class martealertTable
public static void main(java.lang.String[] args)
addresses
class.
args
- - not used.
|
|||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | ||||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |