Pyxarf-轻松生成X-ARF报告
pyxarf的Python项目详细描述
Pyxarf-轻松生成X-ARF报告
简介
pyxarf是一个用于处理x-arf网络滥用报告的python库。
- pyxarf：用于创建、验证和序列化x-arf对象的模块。
- x arf mail：通过电子邮件发送x-arf报告的模块，具有免费的querycontacts库提供的自动滥用联系人查找功能。
- xarfutil：一个命令行客户机，用于直接从shell在x-arf中进行报告。
有关报告格式x-arf的更多信息，请查看它是offical website。
开始
安装
pip install pyxarf
调用脚本
报告生成
在第一个示例中，生成x-arf报告所需的所有参数都是
直接在命令行指定。使用--output-yaml参数，
已验证的报表数据以yaml格式打印到stdout。
$ xarfutil.py --evidence 'sample evidence data' --greeting 'greeting text here'\ --schema-url 'http://xarf.org/schema/abuse_login-attack_0.1.2.json'\ --schema-cache '/tmp/' --reported-from 'xarf-reports@example.com'\ --category 'abuse' --report-type 'login-attack' --report-id '1234567'\ --date 'Feb 3 2014 02:13:35 +0100' --source '83.169.54.26'\ --source-type 'ip-address' --attachment 'text/plain' --service 'ssh'\ --port 22 --output-yaml evidence: sample evidence data machine_readable: Attachment: text/plain Category: abuse Date: Feb 3201402:13:35 +0100 Port: 22 Report-ID: '1234567' Report-Type: login-attack Reported-From: xarf-reports@example.com Schema-URL: http://xarf.org/schema/abuse_login-attack_0.1.2.json Service: ssh Source: 83.169.54.26 Source-Type: ip-address User-Agent: pyxarf 0.0.1
发送报告
通过添加特定参数，可以使用脚本发送报告。
$ xarfutil.py --evidence 'sample evidence data'\ --greeting 'greeting text here'\ --schema-url 'http://xarf.org/schema/abuse_login-attack_0.1.2.json'\ --schema-cache '/tmp/' --reported-from 'xarf@example.org'\ --category 'abuse' --report-type 'login-attack' --report-id '1234567'\ --date 'Feb 3 2014 02:13:35 +0100' --source '83.169.54.26'\ --source-type 'ip-address' --attachment 'text/plain' --service 'ssh'\ --port 22 --mail-server-host mx.example.org --mail-server-port 25\ --mail-from 'xarf@example.org' --mail-subject 'x-arf sample report'\ --mail-to 'abuse@example.com' --send-email Report sent.
您还可以通过添加参数--lookup-contact查找给定IP的滥用联系人。
使用API
from__future__importprint_functionfrompyxarfimportXarfxarf=Xarf(evidence='sample evidence data',greeting='greeting text here',schema_url='http://www.xarf.org/schema/abuse_login-attack_0.1.2.json',schema_cache='/tmp/',reported_from='xarf-reports@example.com',category='abuse',report_type='login-attack',report_id='1234567',date='Feb 3 2014 02:13:35 +0100',source='83.169.54.26',source_type='ip-address',attachment='text/plain',service='ssh',port=22,)print(xarf.to_json())# return jsonprint()print(xarf.to_yaml())# return yamlprint()print(xarf.get_report_obj())# return python object (dict)
输出：
$ python sample.py
{"machine_readable": {"Reported-From": "xarf-reports@example.com", "Report-ID": "1234567", "Category": "abuse", "Report-Type": "login-attack", "Service": "ssh", "Port": 22, "Date": "Feb 3 2014 02:13:35 +0100", "Source": "83.169.54.26", "Source-Type": "ip-address", "Attachment": "text/plain", "Schema-URL": "http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json", "User-Agent": "pyxarf 0.0.5"}, "evidence": "sample evidence data"}
evidence: sample evidence data
machine_readable:
Attachment: text/plain
Category: abuse
Date: Feb 3 2014 02:13:35 +0100
Port: 22
Report-ID: '1234567'
Report-Type: login-attack
Reported-From: xarf-reports@example.com
Schema-URL: http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json
Service: ssh
Source: 83.169.54.26
Source-Type: ip-address
User-Agent: pyxarf 0.0.5
{'machine_readable': {'Reported-From': 'xarf-reports@example.com', 'Report-ID': '1234567', 'Category': 'abuse', 'Report-Type': 'login-attack', 'Service': 'ssh', 'Port': 22, 'Date': 'Feb 3 2014 02:13:35 +0100', 'Source': '83.169.54.26', 'Source-Type': 'ip-address', 'Attachment': 'text/plain', 'Schema-URL': 'http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json', 'User-Agent': 'pyxarf 0.0.5'}, 'evidence': 'sample evidence data'}
检测错误
下面的示例在第17行包含一个错误，作为指定的json模式
定义port为整数。
from__future__importprint_functionfrompyxarfimportXarfxarf=Xarf(evidence='sample evidence data',greeting='greeting text here',schema_url='http://www.xarf.org/schema/abuse_login-attack_0.1.2.json',schema_cache='/tmp/',reported_from='xarf-reports@example.com',category='abuse',report_type='login-attack',report_id='1234567',date='Feb 3 2014 02:13:35 +0100',source='83.169.54.26',source_type='ip-address',attachment='text/plain',service='ssh',port='22',)print(xarf.to_json())
输出：
$ python sample.py
Traceback (most recent call last):
File "sample.py", line 22, in <module>
print(xarf.to_json())
File "/home/user/dev/python-xarf/pyxarf/xarf.py", line 362, in to_json
return json_dumps(self.get_report_obj(part))
File "/home/user/dev/python-xarf/pyxarf/xarf.py", line 395, in get_report_obj
'machine_readable': self._get_validated_machine_readable(),
File "/home/user/dev/python-xarf/pyxarf/xarf.py", line 338, in _get_validated_machine_readable
self.machine_readable
File "/home/user/dev/python-xarf/pyxarf/xarf.py", line 290, in _validate_schema
', '.join(errors)
pyxarf.exceptions.ValidationError: Port '22' is not of type 'integer'
欢迎加入QQ群-->： 979659372
