andreashappe/mod_security_importer

Imports mod_security incidents into a sqlite3 database and performs (minimalist) analysis upon those

mod_security Log Importer

This tool is intended to import mod_security's incident logs into one or more database. Multiple simple analysis tool will try to extract data to support ongoing support work on the deployed mod_security rule set.

I haven't written Python code in a couple of months, so please cope with included rubyisms.

setup

1. repository auschecken
2. virtualenv env
3. source env/bin/activate
4. python setup.py install

(requirements are mostly down to sqlalchemy and noste)

if using postgres, create a database

CREATE USER modsec WITH PASSWORD 'modsec'; CREATE DATABASE modsec; GRANT ALL PRIVILEGES ON DATABASE modsec to modsec; \q

run tests

(env)[~/workspace/testproject]$ nosetests                                           
Ran 15 tests in 0.201s
OK

import data

(env)[~/workspace/testproject]$ bin/import
usage: import [-h] [--import-parts] database File [File ...]
import: error: too few arguments
 
(env)[~/workspace/testproject]$ bin/import --import-parts testme.sqlite /home/andy/Downloads/Mod_Security_Logs/*
also adding parts!
parsing /home/andy/Downloads/Mod_Security_Logs/20150330-230822-VRm7Rgr5AlMAACss5wwAAABE.txt
adding /home/andy/Downloads/Mod_Security_Logs/20150330-230822-VRm7Rgr5AlMAACss5wwAAABE.txt to db
parsing /home/andy/Downloads/Mod_Security_Logs/20150330-231038-VRm7zgr5AlMAAClwIZoAAAAU.txt
adding /home/andy/Downloads/Mod_Security_Logs/20150330-231038-VRm7zgr5AlMAAClwIZoAAAAU.txt to db
parsing /home/andy/Downloads/Mod_Security_Logs/20150509-175403-VU4tmwr5AlMAABZIdvcAAAEW.txt
adding /home/andy/Downloads/Mod_Security_Logs/20150509-175403-VU4tmwr5AlMAABZIdvcAAAEW.txt to db
parsing /home/andy/Downloads/Mod_Security_Logs/20150509-175413-VU4tpQr5AlMAABOvDLQAAAJM.txt
adding /home/andy/Downloads/Mod_Security_Logs/20150509-175413-VU4tpQr5AlMAABOvDLQAAAJM.txt to db

Create a simple data listing

• bin/analyze_destinations
• bin/analyze_simple