Dear all,
Herewith my first attempt at parsing a specific log in memory to submit its contents to DShield.org. I have always used the DShield.org lists but noticed that:
- 1 → Some other “characters” also scan me …
- 2 → I always use, but never really contribute … this is an effort to start to change that behaviour of mine …
Some things to note about this script:
- 1 → This is my first submission of a script, and thus please help improve upon it and provide constructive feedback;
- 2 → You need to have had a look at https://isc.sans.edu/howto.html. The idea is simple: submit the right stuff and you help them, submit the wrong stuff and you will just make things worse (it took me a while to get a method for obtaining a “good enough” address-list/log combination to work). So register with DShield, accept some feedback, and above all, test first!!!
;
- 3 → The “log parsing” of this script do not cater for NAT. I do not need it, but I can think of several situations where this might actually be rather important/handy to have. So please feel free to add the functionality;
- 4 → The script is based on the logging mechanism of dropped packets by the firewall. Currently only the input chains are catered for;
- 5 → You should be able to send e-mails from your mikrotik router;
- 6 → You should have this script execute at a minimum of once every 24 hours … I currently have it for once every 6 hours just to be on the safe side;
- 7 → You should test script with your own e-mail address first;
- 8 → This script works in ROS v6.20, I have not tested this in other versions;
- 9 → This script does not have any comments, apart from the area where you have to change variables for your purposes, … I know this is terrible … But I ran out of time … maybe when some other coder starts providing improvements can I look at it again …;
I have to admit the script editing was rather “challenging” 
, as I had to copy and paste between Notepad++ and WinBox the whole time to figure out the error locations etc. Not too mention the “inspection” of variables with all the “:put” commands. A type of IDE within WinBox would be awesome especially to “watch” variables … for the only information I could obtain on the command’s results such as [:toarray /print as-value X] was to actually go and :foreach x,y and then :put it … Then again … I might have been scratching my nose through my “behind” … so feedback on improving my method of “coding” will also be appreciated …
Having said that, now that I am past the initial “learning curve” … the ROS Scripting makes more sense, and is quite powerful …
:local logToParse;
:local currentLogBuffer;
:local currentMonth;
:local currentDay;
:local logEntryYear;
:local logEntryMonth;
:local logEntryDay;
:local logEntryTime;
:local currentYear;
:local currentDate;
:local tempString;
:local tempStringLength;
:local tempPos;
:local currentLogEntryTime;
:local currentLogEntryProtocol;
:local currentLogEntryProtocolFlags;
:local currentLogEntrySourceAddress;
:local currentLogEntrySourcePort;
:local currentLogEntryDestinationAddress;
:local currentLogEntryDestinationPort;
:local months ("jan","feb","mar","apr","may","jun","jul","aug","sep","oct","nov","dec");
:local timeZone;
:local dshieldClientID;
:local dshieldAddress;
:local dshieldEMailBody;
:local dshieldEMailSubject;
:local logLines;
# Edit the following four variables to reflect your own information
:set logToParse "DShieldLog";
:set timeZone "+02:00";
:set dshieldClientID "123456789";
:set dshieldAddress "reports@dshield.org";
:set currentLogBuffer [ /log print as-value where buffer=$logToParse];
:set currentDate [/system clock get date];
:set currentMonth [:pick [:tostr $currentDate] 0 3];
:set currentDay [:pick [:tostr $currentDate] 4 6];
:set currentYear [:pick [:tostr $currentDate] 7 11];
:set dshieldEMailBody "";
:set dshieldEMailSubject ("FORMAT DSHIELD USERID " . $dshieldClientID . " TZ " . $timeZone);
/system logging action {
:set logLines [get ($logToParse) memory-lines]
set ($logToParse) memory-lines 1
set ($logToParse ) memory-lines $logLines
}
:foreach logEntryItem in=$currentLogBuffer do={
:set currentLogEntryTime ($logEntryItem->"time");
:set tempString ($logEntryItem->"message");
:set tempStringLength [:len $tempString]
:set tempPos ([:find [:tostr $tempString] ","])
:set tempString [:pick $tempString ($tempPos+2) $tempStringLength ]
:set tempPos ([:find [:tostr $tempString] ","])
:set currentLogEntryProtocol [:pick $tempString 6 $tempPos]
:if (:len [:find [:tostr $currentLogEntryProtocol] "("] > 0) do={
:set tempPos ([:find [:tostr $tempString] ")"]);
:set currentLogEntryProtocol [:pick $tempString 6 $tempPos];
:set tempStringLength [:len $currentLogEntryProtocol]
:set tempPos ([:find [:tostr $currentLogEntryProtocol] "("])
:set currentLogEntryProtocolFlags [:pick $currentLogEntryProtocol ($tempPos+1) ($tempStringLength)]
:set currentLogEntryProtocol [:pick $currentLogEntryProtocol 0 ($tempPos-1)]
:set tempStringLength [:len $tempString]
:set tempPos ([:find [:tostr $tempString] ")"])
:set tempString [:pick $tempString ($tempPos+3) $tempStringLength ]
} else={
:set tempPos ([:find [:tostr $tempString] ","])
:set tempString [:pick $tempString ($tempPos+2) $tempStringLength ]
:set currentLogEntryProtocolFlags "";
}
:set tempPos [:find [:tostr $currentLogEntryTime] " "]
:if ([:len $tempPos] = 0) do={
:set logEntryMonth $currentMonth;
:set logEntryDay $currentDay;
:set logEntryYear $currentYear;
:set logEntryTime $currentLogEntryTime;
}
:if ($tempPos = 6) do={
:set logEntryYear $currentYear;
:set logEntryTime [:pick [:tostr $currentLogEntryTime] ($tempPos + 1) [:len [:tostr $currentLogEntryTime]]];
:set logEntryMonth [:pick [:tostr $currentLogEntryTime] 0 [:find $currentLogEntryTime "/"]];
:set logEntryDay [:pick [:tostr $currentLogEntryTime] ([:find $currentLogEntryTime "/"] + 1) $tempPos];
}
:if ($tempPos = 3) do={
:set logEntryYear $currentYear;
:set logEntryDay $currentDay;
:set logEntryTime [:pick [:tostr $currentLogEntryTime] ($tempPos + 1) [:len [:tostr $currentLogEntryTime]]];
:set logEntryMonth [:pick [:tostr $currentLogEntryTime] 0 $tempPos];
}
:set tempPos ([ :find $months $logEntryMonth -1 ] + 1);
:if ($tempPos < 10) do={
:set logEntryMonth ("0" . $tempPos);
} else={
:set logEntryMonth ($tempPos);
}
:set tempPos ([:find [:tostr $tempString] ":"])
:set currentLogEntrySourceAddress [:pick $tempString 0 $tempPos]
:set tempStringLength [:len $tempString]
:set tempString [:pick $tempString ($tempPos+1) $tempStringLength ]
:set tempPos ([:find [:tostr $tempString] "->"])
:set currentLogEntrySourcePort [:pick $tempString 0 $tempPos]
:set tempStringLength [:len $tempString]
:set tempString [:pick $tempString ($tempPos+2) $tempStringLength ]
:set tempPos ([:find [:tostr $tempString] ":"])
:set currentLogEntryDestinationAddress [:pick $tempString 0 $tempPos]
:set tempStringLength [:len $tempString]
:set tempString [:pick $tempString ($tempPos+1) $tempStringLength ]
:set tempPos ([:find [:tostr $tempString] ","])
:set currentLogEntryDestinationPort [:pick $tempString 0 $tempPos]
:set tempString ($logEntryYear . "-" . $logEntryMonth . "-" . $logEntryDay . " " . $logEntryTime . " " . $timeZone . "\t" . $dshieldClientID . "\t");
:set tempString ($tempString . "1" . "\t" . $currentLogEntrySourceAddress . "\t" . $currentLogEntrySourcePort . "\t");
:set tempString ($tempString . $currentLogEntryDestinationAddress . "\t" . $currentLogEntryDestinationPort . "\t" . $currentLogEntryProtocol . "\t" . $currentLogEntryProtocolFlags . "\n");
:set dshieldEMailBody ($dshieldEMailBody . $tempString);
}
/tool e-mail send to="$dshieldAddress" subject="$dshieldEMailSubject" body="$dshieldEMailBody"
/log info ("[DShield Submission] E-Mail Sent to $dshieldAddress")