bwxslogtool.py -- This tool parses sip messages out of the broadworks App Server's XS log
usage: bwfraud.py [-h] [-m REGEX] [-d DIR] [-t REGEX] [-x W:C] [-s MINS] [-w FILE] [-D DAYS] XSLog
bwfraud tool analyzes BroadWorks XS logs for call patterns
to detect possible unauthorized call usage
positional arguments:
XSLog XSLog to parse
optional arguments:
-h, --help show this help message and exit
-m REGEX, --match REGEX
Pattern to match
-d, --dir DIR Direction of message (IN, OUT)
-t, --to REGEX Pattern to match To: header
-x, --xtract WARN:CRIT
Extract calls exceeding thresholds
-s, --span MINS Time span for threshold count
-w, --whitelist FILE Use a whitelist configured in FILE
-D, --days DAYS When using whitelist, number of DAYS
to keep an entry in the automatic
whitelist (default 14)
The -m flag takes a regular expression to match against the messages. Something like the following would print all SIP INVITE messages in the given file:
./bwxslogtool.py -m "^INVITE" XSLogFile
Then if you wanted to see a call with a specific call-id you would do something like the following:
./bwxslogtool.py -m "<YOUR_CALL_ID_HERE>" XSLogFile
The -d flag accepts either IN or OUT, to select only incoming or only outgoing calls from the given log file, respectively.
The -t flag accepts a regular expression to match against the To: header. This is a more specific form of the -m flag.
The -x flag changes the tool's behavior to count the frequency of log entries selected for each calling number over a time period specified via the -s flag. The accepted values consist of the warning and critical thresholds over the specified time span. When combined with the -m flag to select INVITE events, one can use this mode to report on excessive call usage.
The -w flag supplements the -x flag through the use of whitelisting. The file specified in FILE will contain a JSON object pointing to two whitelist files for the automatic and manual whitelist files (also JSON format). The automatic whitelist will populate automatically with entries reported by the -x flag and will expire after the number of days specified with the -D flag (default 14 days).