modules.processing.suricata.Suricata

Package modules :: Package processing :: Module suricata :: Class Suricata |
[hide private]
[frames] | no frames]

# Class Suricata

source code

                                object --+
                                         |
    lib.cuckoo.common.abstracts.Processing --+
                                             |
                                            Suricata

Suricata processing module.

Instance Methods | [hide private]
process_pcap_socket(self) Process a PCAP file with Suricata in socket mode. | source code
process_pcap_binary(self) Process a PCAP file with Suricata by running Suricata. | source code
parse_eve_json(self) Parse the eve.json file. | source code
parse_files(self) Parse the files-json.log file and its associated files. | source code
run(self) Start processing. | source code
Inherited from `lib.cuckoo.common.abstracts.Processing`: `__init__`, `set_baseline`, `set_options`, `set_path`, `set_results`, `set_task` Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Class Variables | [hide private]
| sid_blacklist = `[2200074, 2017363, 2200075,]`
Inherited from `lib.cuckoo.common.abstracts.Processing`: `enabled`, `order`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### process_pcap_binary(self) | source code
Process a PCAP file with Suricata by running Suricata. Using the socket mode is preferred as the plain binary mode requires Suricata to load all its rules for every PCAP file and thus takes a couple of performance heavy seconds to set itself up.

### run(self) | source code
Start processing. Raises: `NotImplementedError` - this method is abstract. Overrides: lib.cuckoo.common.abstracts.Processing.run (inherited documentation)