#!/usr/bin/perl



###

# Parse text-based log files of Snort alerts, and save them

# to a file in Berkley DB format.



###

# Load necessary libraries.

require "init.pl";





###

# Initialize output alert database.

if (-e $ALERTDB) {

    die "Output alert database $ALERTDB already exists. Exiting.\n";

}

if (! tie(%ALERTDB, "DB_File", $ALERTDB)) {

    die "Could not initialize output alert database $ALERTDB:\n$!\n";

}





###

# Process every line on STDIN or in files passed on command line.

$counter = 0;

$dbdelim = "*";

while (<>) {



    # Display a message every time a new file is being processed.

    if ($VERBOSE) {

	if ($ARGV eq "-") {

	    $infile = "STDIN";

	} else {

	    $infile = $ARGV;

	}

	if (! $PROCESSED_FILES{$infile}) {

	    warn "Processing $infile...\n";

	    $PROCESSED_FILES{$infile} = 1;

	}

    }



    # Skip empty lines, lines with nothing but stars, and title lines.

    # Also skip lines that don't start with a date, but warn about that.

    next if ((/^\s*\**\s*$/) || (/^\s*Snort Alert Report/));

    if (! /^\d\d\/\d\d\-/) {

	warn "No leading date: $_";

	next;

    }



    # Separate the line into meaningful fields.

    chop;

    ($timestamp, $name, $details) = split(/\s*\[\*\*\]\s*/);

    if ($timestamp =~ /^\s*$/) {

	warn "Timestamp empty ([**] $name [**] $details)\n";

	next;

    }

    if ($name =~ /^\s*$/) {

	warn "Alert name empty ($timestamp .. $details)\n";

	next;

    }

    if ($details =~ /^\s*$/) {

	# In some alerts these are empty.

	($src, $dst, $srchost, $srcport, $dsthost, $dstport) = ();

    } else {

	($src, $dst) = split(/ \-> /, $details);

	($srchost, $srcport) = split(/:/, $src);

	($dsthost, $dstport) = split(/:/, $dst);

	if (($srchost =~ /^\s*$/) || ($dsthost =~ /^\s*$/)) {	

	    # Hosts cannot be empty, but ports are in some alerts.

	    warn "Details corrupted ($timestamp)\n";

	    next;

	}

    }



    # Write alert to the database.

    $ALERTDB{$counter++} = $timestamp . $dbdelim . $name . $dbdelim .

	                   $srchost . $dbdelim . $srcport . $dbdelim .

                           $dsthost . $dbdelim . $dstport;

}





###

# Clean up and exit.

untie(%ALERTDB);