modules.reporting.moloch

Package modules :: Package reporting :: Module moloch |
[hide private]
[frames] | no frames]

# Source Code for Module modules.reporting.moloch

     1  # Copyright (C) 2010-2013 Claudio Guarnieri.
     2  # Copyright (C) 2014-2016 Cuckoo Foundation.
     3  # This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
     4  # See the file 'docs/LICENSE' for copying permission.
     5
     6  import logging
     7  import os.path
     8  import subprocess
     9
    10  from lib.cuckoo.common.abstracts import Report
    11  from lib.cuckoo.common.exceptions import CuckooProcessingError
    12
    13  log = logging.getLogger(__name__)
    14
    15 -class Moloch(Report):
    16      """Moloch reporting module."""
    17
    18 -    def run(self, results):
    19          self.moloch_capture = \
    20              self.options.get("moloch_capture", "/data/moloch/bin/moloch-capture")
    21          self.config_path = self.options.get("conf", "/data/moloch/etc/config.ini")
    22          self.instance = self.options.get("instance", "cuckoo")
    23
    24          if not os.path.isfile(self.pcap_path):
    25              log.warning("Unable to run Moloch as no pcap is available")
    26              return
    27
    28          if not os.path.isfile(self.moloch_capture):
    29              raise CuckooProcessingError("Unable to locate Moloch binary")
    30
    31          if not os.path.isfile(self.config_path):
    32              raise CuckooProcessingError(
    33                  "Unable to locate Moloch configuration"
    34              )
    35
    36          args = [
    37              self.moloch_capture,
    38              "-c", self.config_path,
    39              "-r", self.pcap_path,
    40              "-n", self.instance,
    41              "-q",
    42          ]
    43
    44          tags = {}
    45          tags[self.instance] = self.task["id"]
    46
    47          if self.task["category"] == "file":
    48              # Tag file hashes.
    49              f = results.get("target", {}).get("file", {})
    50              for field in ("md5", "sha1", "sha256", "sha512"):
    51                  if field in f:
    52                      tags[field] = f[field]
    53
    54              # Tag normalized VirusTotal results.
    55              for variant in results.get("virustotal", {}).get("normalized", []):
    56                  tags["virustotal"] = variant
    57
    58          for key, value in tags.items():
    59              args += [
    60                  "-t", "%s:%s" % (key, value),
    61              ]
    62
    63          try:
    64              subprocess.check_call(args)
    65          except subprocess.CalledProcessError as e:
    66              raise CuckooProcessingError(
    67                  "Error submitting PCAP to Moloch: %s" % e)
    68