Package modules :: Package processing :: Module suricata :: Class Suricata
[hide private]
[frames] | no frames]

Class Suricata

source code

                            object --+    
                                     |    
lib.cuckoo.common.abstracts.Processing --+
                                         |
                                        Suricata

Suricata processing module.

Instance Methods [hide private]
 
process_pcap_socket(self)
Process a PCAP file with Suricata in socket mode.
source code
 
process_pcap_binary(self)
Process a PCAP file with Suricata by running Suricata.
source code
 
parse_eve_json(self)
Parse the eve.json file.
source code
 
parse_files(self)
Parse the files-json.log file and its associated files.
source code
 
run(self)
Start processing.
source code

Inherited from lib.cuckoo.common.abstracts.Processing: __init__, set_baseline, set_options, set_path, set_results, set_task

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables [hide private]
  sid_blacklist = [2200074, 2017363, 2200075,]

Inherited from lib.cuckoo.common.abstracts.Processing: enabled, order

Properties [hide private]

Inherited from object: __class__

Method Details [hide private]

process_pcap_binary(self)

source code 

Process a PCAP file with Suricata by running Suricata.

Using the socket mode is preferred as the plain binary mode requires Suricata to load all its rules for every PCAP file and thus takes a couple of performance heavy seconds to set itself up.

run(self)

source code 

Start processing.

Raises:
  • NotImplementedError - this method is abstract.
Overrides: lib.cuckoo.common.abstracts.Processing.run
(inherited documentation)