| Tipo evento |
Data evento |
Descrizione evento |
Controllo NOC |
*/
$DATA_AR = array();
$DATA_MAP = array();
$COLLECTED_IP = array();
$COLLECTED_LOCATION = array();
mysql_connect($LOG_IP_ADDRESS, $LOG_USERNAME, $LOG_PASSWORD);
mysql_select_db($LOG_DB_NAME);
$Q = mysql_query("SELECT * FROM SystemEvents WHERE FromHost = 'BLACKBOX_TEST' AND SysLogTag IN ('CRITICAL:', 'WARNING:', 'INFO:', 'INTRUSION:') AND Message NOT LIKE '%api%' AND Message NOT LIKE '%telnet%' ORDER BY id DESC LIMIT 200;");
$RC = mysql_num_rows($Q);
while ($DATA = mysql_fetch_assoc($Q)) {
if ($DATA['SysLogTag'] == 'CRITICAL:' or $DATA['SysLogTag'] == 'WARNING:' or $DATA['SysLogTag'] == 'INFO:' or $DATA['SysLogTag'] == 'INTRUSION:') {
switch ($DATA['SysLogTag']) {
case "INTRUSION:":
$NOC = 'Verificato';
$TYPE = 'Firewall';
$F_COLOR = '#D9534F';
$ICON = '';
$Message = $DATA['Message'];
$MessageA = explode(",", $Message);
$NMessage = explode("->", $MessageA[2]);
$AttackIP = explode(":", $NMessage[0]);
$SRC_IP_ADDRESS = str_replace(" proto UDP", "", $AttackIP[0]);
$SRC_IP_ADDRESS = str_replace(" ", "", $SRC_IP_ADDRESS);
$Message = 'Tentativo di accesso da '.$SRC_IP_ADDRESS.' bloccato dalla BlackBox';
mysql_connect($LDB_IP_ADDRESS, $LDB_USERNAME, $LDB_PASSWORD);
mysql_select_db($LDB_DB_NAME);
$QH = mysql_query("SELECT * FROM bb_daemon_history WHERE ip_address = '".$SRC_IP_ADDRESS."';");
if (mysql_num_rows($QH) == 0) {
//APPLICARE SOLO IN FASE DI PRODUZIONE
$COLLECTED_IP[] = $SRC_IP_ADDRESS;
$details = json_decode(file_get_contents("http://ipinfo.io/{$SRC_IP_ADDRESS}/json"));
//if (!in_array($details->loc, $COLLECTED_LOCATION)) {
$COLLECTED_LOCATION[] = $details->loc;
$LOC = explode(",", $details->loc);
$DATA_MAP[] = array('LAT' => $LOC[0], 'LON' => $LOC[1], 'IP' => $SRC_IP_ADDRESS, 'ORG' => $details->org );
//}
mysql_query("INSERT INTO bb_daemon_history (ip_address, latitudine, longitudine, org) VALUES ('".$SRC_IP_ADDRESS."', '".$LOC[0]."', '".$LOC[1]."', '".$details->org."');");
} else {
$QHD = mysql_query("SELECT * FROM bb_daemon_history WHERE ip_address = '".$SRC_IP_ADDRESS."';");
$DATAH = mysql_fetch_assoc($QHD);
$DATA_MAP[] = array('LAT' => $DATAH['latitudine'], 'LON' => $DATAH['longitudine'], 'IP' => $SRC_IP_ADDRESS, 'ORG' => $DATAH['org']);
}
//APPLICARE SOLO IN FASE DI PRODUZIONE
/* $COLLECTED_IP[] = $SRC_IP_ADDRESS;
$details = json_decode(file_get_contents("http://ipinfo.io/{$SRC_IP_ADDRESS}/json"));
if (!in_array($details->loc, $COLLECTED_LOCATION)) {
$COLLECTED_LOCATION[] = $details->loc;
$LOC = explode(",", $details->loc);
$DATA_MAP[] = array('LAT' => $LOC[0], 'LON' => $LOC[1]);
} */
break;
case "CRITICAL:":
$NOC = 'Verificato';
$TYPE = 'Danger';
$F_COLOR = '#D9534F';
$ICON = '';
$Message = $DATA['Message'];
$Message = str_replace('login failure for user', 'Negato accesso utente', $Message);
$Message = str_replace('from', 'da IP', $Message);
$Message = str_replace('via winbox', '', $Message);
break;
case "WARNING:":
$NOC = 'Verificato';
$TYPE = 'Warning';
$F_COLOR = 'orange';
$ICON = '';
$Message = $DATA['Message'];
break;
case "INFO:":
$NOC = 'Verificato';
$TYPE = 'Info';
$F_COLOR = '#5BC0DE';
$ICON = '';
$Message = $DATA['Message'];
$Message = str_replace('user admin', '', $Message);
$Message = str_replace('logged in', 'Il NOC ha eseguito l\'accesso alla BlackBox', $Message);
$Message = str_replace('logged out', 'Il NOC si รจ disconnesso dalla BlackBox', $Message);
$Message = str_replace('from', 'da IP', $Message);
$Message = str_replace('via winbox', '', $Message);
//$Message = str_replace('via telnet', '', $Message);
break;
default:
$NOC = 'Verificato';
$TYPE = 'Normal';
$F_COLOR = 'gray';
$ICON = '';
$Message = $DATA['Message'];
}
$EventData = strtotime($DATA['ReceivedAt']);
$EventData = date('d/m/Y H:i:s', $EventData);
$DATA_AR[] = array($ICON, $TYPE, ''.$EventData.'', ''.$Message.'', $NOC);
}
}
mysql_close();
$RESPONSE_ARRAY['LogTableRecords'] = $DATA_AR;
$RESPONSE_ARRAY['LogMapRecords'] = $DATA_MAP;
print json_encode($RESPONSE_ARRAY);
/* $DATA_AR[0] = array("Ciao", "sono", "antonio", "martino", "1");
$DATA_AR[1] = array("Io", "sono", "antonio", "martino", "1");
*/
?>