Lilith reads in EVE files from Suricata and Sagan into PostgreSQL.
From there that data can then be searched and information on specific events fetched.
apt-get install zlib1g-dev cpanminus libdbi-perl libdbix-class-perl \
libdata-dumper-perl libdigest-sha-perl libfile-slurp-perl libjson-perl \
libnet-server-perl libpoe-perl libtoml-perl
cpanm Lilith
pkg install p5-App-cpanminus p5-DBI p5-DBIx-Class p5-DBD-Pg \
p5-Data-Dumper p5-Digest-SHA p5-File-Slurp p5-JSON p5-MIME-Base64 \
p5-Net-Server p5-POE p5-Sys-Syslog p5-Term-ANSIColor \
p5-Text-ANSITable p5-Time-Piece p5-TOML
cpanm Lilith
perl Makefile.PL
make
make test
make install
First you need to setup your PostgreSQL server.
createuser -D -l -P -R -S lilith
createdb -E UTF8 -O lilith lilith
Setup /usr/local/etc/lilith.toml
dsn="dbi:Pg:dbname=lilith;host=192.168.1.2"
pass="WhateverYouSetAsApassword"
user="lilith"
# a handy one to ignore for the extend as it is spammy
class_ignore=["Generic Protocol Command Decode"]
# add a suricata instance to monitor
[suricata-eve]
instance="foo-pie"
type="suricata"
eve="/var/log/suricata/alert.json"
# add a second suricata instance to monitor
[another-eve]
instance="foo2-pie"
type="suricata"
eve="/var/log/suricata/alert2.json"
# add a sagan eve to monitor
# instance name is 'foo-lae', given there is no value for instance
[foo-lae]
type="sagan"
eve="/var/log/sagan/alert.json"
Now we just need to setup the tables.
lilith -a create_tables
If using snmpd.
extend lilith /usr/local/bin/lilith -a extend
The default config file is /usr/local/etc/lilith.toml.
| Variable | Description |
|---|---|
| dsn | A DSN connection string to be used by [DBI][https://metacpan.org/pod/DBI]. [DBD::Pg][https://metacpan.org/pod/DBD::Pg] |
| pass | Password to use for the connection. |
| user | User to use for the connetion. |
| class_ignore | Array of classes to ignore. |
Sub hashes are then treated as a instance. The following values are available for that.
| Variable | Required | Description |
|---|---|---|
| eve | yes | The EVE file to follow. |
| type | yes | sagan or suricata, depending on which it is. |
| instance | no | The name for the instance. If not specified the hash name is used. |
lilith [B<-c> <config>] B<-a> run
lilith [B<-c> <config>] B<-a> class_map
lilith [B<-c> <config>] B<-a> create_tables
lilith [B<-c> <config>] B<-a> dump_self
lilith [B<-c> <config>] B<-a> event [B<-t> <table>] B<--id> <row_id> [B<--raw>]
[[B<--pcap> <output file>] [B<--virani> <remote>] [B<--buffer> <buffer secodns>]]
lilith [B<-c> <config>] B<-a> event [B<-t> <table>] B<--event> <event_id> [B<--raw>]
[[B<--pcap> <output file>] [B<--virani> <remote>] [B<--buffer> <buffer secodns>]
lilith [B<-c> <config>] B<-a> extend [B<-Z>] [B<-m> <minutes>]
lilith [B<-c> <config>] B<-a> get_short_class_snmp_list
lilith [B<-c> <config>] B<-a> search [B<--output> <return>] [B<-t> <table>]
[B<-m> <minutes>] [B<--order> <clm>] [B<--limit> <int>] [B<--offset> <int>]
[B<--orderdir> <dir>] [B<--si> <src_ip>] [B<--di> <<dst_ip>] [B<--ip> <ip>]
[B<--sp> <<src_port>] [B<--dp> <<dst_port>] [B<--port> <<port>] [B<--host> <host>]
[B<--ih> <host>] [B<-i> <instance>] [B<-c> <class>] [B<-s> <sig>] [B<--if> <if>]
[B<--ap> <proto>] [B<--gid> <gid>] [B<--sid> <sid>] [B<--rev> <rev>]
[B<--subip> <subip>] [B<--subhost> <subhost>] [B<--slug> <slug>] [B<--pkg> <pkg>]
[B<--malscore> <malscore>] [B<--size> <size>] [B<--target> <target>]
[B<--task> <task>]
The action to perform.
- Default :: search
The config file to use.
- Default :: /usr/local/etc/lilith.toml
Table to operate on.
- Default :: suricata
=head1 ACTIONS
Start processing the EVE logs and daemonize.
Print a table of class mapping from long name to the short name used for display in the search results.
Create the tables in the DB.
Initiate Lilith and then dump it via Data::Dumper.
Fetches a event. The table to use can be specified via -t.
Fetch event via row ID.
Fetch the event via the event ID.
Do not decode the EVE JSON.
Fetch the remote PCAP via Virani and write it to the file. Only usable for with Suricata tables.
Default :: undef
Virani setting to pass to -r.
Default :: instance name in alert
How many seconds to pad the start and end time with.
Default :: 60
Prints a LibreNMS style extend.
Enable Gzip+Base64 LibreNMS style extend compression.
How far back to search. For the extend action, 5 minutes is the default.
The directory to write it out too.
Print a list of shorted class names for use with SNMP.
Search the DB. The table may be specified via -t.
The common option types for search are as below.
- Integer :: A comma seperated list of integers to check for. Any number
prefixed with a ! will be negated.
- String :: A string to check for. May be matched using like or negated via
the proper options.
- Complex :: A item to match.
- IP :: An IP.
The output type.
- Values :: table,json
- Default :: table
How far back to to in minutes.
- Default :: 1440
- Default, extend :: 5
Column to use for sorting by.
- Default :: timestamp
- Cape Default :: stop
Direction to order in.
- Values :: ASC,DSC
- Default :: ASC
Source IP.
- Default :: undef
- Type :: IP
Destination IP.
- Default :: undef
- Type :: IP
IP, either dst or src.
- Default :: undef
- Type :: complex IP
Source port.
- Default :: undef
- Type :: integer
Destination port.
- Default :: undef
- Type :: integer
Port, either dst or src.
- Default :: undef
- Type :: complex integer
Sagan :: Host is the sending system and instance host is the host the
instance is running on.
Suricata :: Host is the system the instance is running on. There is no
instance host.
Host.
- Default :: undef
- Type :: string
Instance host.
- Default :: undef
- Type :: string
Instance.
- Default :: undef
- Type :: string
Classification.
- Default :: undef
- Type :: string
Signature.
- Default :: undef
- Type :: string
Interface.
- Default :: undef
- Type :: string
App proto.
- Default :: undef
- Type :: string
GID.
- Default :: undef
- Type :: integer
SID.
- Default :: undef
- Type :: integer
Rev.
- Default :: undef
- Type :: integer
The slug it was submitted with.
- Default :: undef
- Type :: string
The detopnation package used with CAPEv2.
- Default :: undef
- Type :: string
The malscore of the sample.
- Default :: undef
- Type :: integer
The size of the sample.
- Default :: undef
- Type :: integer
The the detonation target.
- Default :: undef
- Type :: string
The task ID of the run.
- Default :: undef
- Type :: integer
The IP the sample was submitted from.
- Default :: undef
- Type :: IP
The host the sample was submitted from.
- Default :: undef
- Type :: string
The LText::ANSITable table color to use.
- Default :: Text::ANSITable::Standard::NoGradation
The LText::ANSITable border type to use.
- Default :: ASCII::None
Perl boolean for if IPs should be colored or not.
- Default :: 1
ANSI color to use for private IPs.
- Default :: bright_green
ANSI color to use for remote IPs.
- Default :: bright_yellow
ANSI color to use for local IPs.
- Default :: bright_red
Perl boolean for if microseconds should be dropped or not.
- Default :: 1
If the lilith instance colomn info should be colored.
- Default :: 1
Color for the instance name.
- Default :: bright_blue
Color for the insance slug.
- Default :: bright_magenta
Color for the insance loc.
- Default :: bright_cyan.