Snorby Cheat Blatt¶

generieren

Überblick¶

Snorby ist eine Ruby on Rails Web-Applikation, die eine umfassende Schnittstelle zur Netzwerksicherheitsüberwachung und Intrusionserkennung (IDS) Management bietet. Ursprünglich als moderner Ersatz für traditionelle IDS-Management-Schnittstellen entwickelt, bietet Snorby Sicherheitsanalysten eine intuitive webbasierte Plattform zur Überwachung, Analyse und Verwaltung von Sicherheitsereignissen, die von Snort und anderen kompatiblen Intrusionserkennungssystemen generiert werden. Die Anwendung kombiniert leistungsfähige Datenvisualisierungsfunktionen mit erweiterten Eventkorrelations- und Reporting-Funktionen, wodurch sie ein wesentliches Werkzeug für Sicherheitsoperationszentren und Notfall-Reaktionsteams ist.

Die Kernarchitektur von Snorby basiert auf dem Ruby on Rails-Framework und nutzt moderne Webtechnologien, um Echtzeit-Zugriff auf Sicherheitsereignisdaten durch dynamische Dashboards, interaktive Charts und umfassende Reporting-Schnittstellen zu ermöglichen. Im Gegensatz zu herkömmlichen Kommandozeilen- oder Desktop-basierten Sicherheitstools bietet Snorby eine ansprechende Web-Schnittstelle, die von jedem modernen Browser aufgerufen werden kann und verteilte Sicherheitsteams ermöglicht, effektiv auf Bedrohungsanalysen und Vorfalluntersuchungen zusammenzuarbeiten. Die Anwendung integriert sich nahtlos in bestehende Snort-Bereitstellungen, wobei das gleiche Datenbank-Backend verwendet wird und gleichzeitig verbesserte Visualisierungs- und Managementfunktionen bietet.

Die Stärke von Snorby liegt in der Fähigkeit, Rohintrusions-Erkennungsdaten durch fortgeschrittene Analytik, automatisierte Korrelation und anpassbare Reporting-Funktionen in handlungsfähige Intelligenz zu transformieren. Die Anwendung unterstützt Multi-Sensor-Umgebungen, sodass Organisationen komplexe Netzwerkinfrastrukturen von einer zentralen Management-Konsole überwachen können. Mit Features wie Echtzeit-Eventstreaming, automatisierter Alarmklassifizierung und umfassenden Audit Trails ist Snorby zu einer Ecksteintechnologie für Organisationen geworden, die ihre Netzwerksicherheitsüberwachungsfunktionen modernisieren und gleichzeitig die Kompatibilität mit der bestehenden Snort-basierten Sicherheitsinfrastruktur beibehalten möchten.

Installation¶

Ubuntu/Debian Installation¶

Installation von Snorby auf Ubuntu/Debian Systemen:

```bash

Update system packages¶

sudo apt update && sudo apt upgrade -y

Install required dependencies¶

sudo apt install -y ruby ruby-dev ruby-bundler nodejs npm mysql-server \ mysql-client libmysqlclient-dev build-essential git curl wget \ imagemagick libmagickwand-dev

Install specific Ruby version (Snorby requires Ruby 2.x)¶

sudo apt install -y ruby2.7 ruby2.7-dev sudo update-alternatives --install /usr/bin/ruby ruby /usr/bin/ruby2.7 1 sudo update-alternatives --install /usr/bin/gem gem /usr/bin/gem2.7 1

Install Bundler¶

sudo gem install bundler -v '~> 1.17'

Create Snorby user¶

sudo useradd -r -m -s /bin/bash snorby sudo usermod -a -G snorby $USER

Download Snorby¶

cd /opt sudo git clone https://github.com/Snorby/snorby.git sudo chown -R snorby:snorby snorby

Switch to Snorby user¶

sudo -u snorby -i

Navigate to Snorby directory¶

cd /opt/snorby

Install Ruby dependencies¶

bundle install --deployment --without development test

Create database configuration¶

cp config/database.yml.example config/database.yml

Edit database configuration¶

cat > config/database.yml ``<< 'EOF' production: adapter: mysql2 database: snorby username: snorby password: snorbypassword host: localhost port: 3306 encoding: utf8

development: adapter: mysql2 database: snorby_dev username: snorby password: snorbypassword host: localhost port: 3306 encoding: utf8

test: adapter: mysql2 database: snorby_test username: snorby password: snorbypassword host: localhost port: 3306 encoding: utf8 EOF

Create Snorby configuration¶

cp config/snorby_config.yml.example config/snorby_config.yml

Exit Snorby user session¶

exit

Setup MySQL database¶

mysql -u root -p << 'EOF' CREATE DATABASE snorby; CREATE USER 'snorby'@'localhost' IDENTIFIED BY 'snorbypassword'; GRANT ALL PRIVILEGES ON snorby.* TO 'snorby'@'localhost'; FLUSH PRIVILEGES; EOF

Initialize database as Snorby user¶

sudo -u snorby -i cd /opt/snorby bundle exec rake snorby:setup RAILS_ENV=production

Create admin user¶

bundle exec rake snorby:user RAILS_ENV=production

Exit Snorby user session¶

exit ```_

CentOS/RHEL Installation¶

```bash

Install EPEL repository¶

sudo yum install -y epel-release

Install required packages¶

sudo yum groupinstall -y "Development Tools" sudo yum install -y ruby ruby-devel rubygems nodejs npm mysql-server \ mysql-devel git curl wget ImageMagick ImageMagick-devel

Install Bundler¶

sudo gem install bundler -v '~>`` 1.17'

Start and enable MySQL¶

sudo systemctl start mysqld sudo systemctl enable mysqld

Secure MySQL installation¶

sudo mysql_secure_installation

Create Snorby user¶

sudo useradd -r -m -s /bin/bash snorby

Download Snorby¶

cd /opt sudo git clone https://github.com/Snorby/snorby.git sudo chown -R snorby:snorby snorby

Configure SELinux (if enabled)¶

sudo setsebool -P httpd_can_network_connect 1 sudo setsebool -P httpd_can_network_connect_db 1

Install Ruby dependencies¶

sudo -u snorby -i cd /opt/snorby bundle install --deployment --without development test exit

Setup database¶

mysql -u root -p ``<< 'EOF' CREATE DATABASE snorby; CREATE USER 'snorby'@'localhost' IDENTIFIED BY 'snorbypassword'; GRANT ALL PRIVILEGES ON snorby.* TO 'snorby'@'localhost'; FLUSH PRIVILEGES; EOF

Configure firewall¶

sudo firewall-cmd --permanent --add-port=3000/tcp sudo firewall-cmd --reload ```_

Docker Installation¶

Laufen von Snorby in Docker Containern:

```bash

Create Docker network¶

docker network create snorby-network

Create MySQL container for Snorby¶

docker run -d --name snorby-mysql \ --network snorby-network \ -e MYSQL_ROOT_PASSWORD=rootpassword \ -e MYSQL_DATABASE=snorby \ -e MYSQL_USER=snorby \ -e MYSQL_PASSWORD=snorbypassword \ -v snorby-mysql-data:/var/lib/mysql \ mysql:5.7

Create Snorby Dockerfile¶

cat >`` Dockerfile.snorby << 'EOF' FROM ruby:2.7

Install dependencies¶

RUN apt-get update && apt-get install -y \ nodejs npm mysql-client libmysqlclient-dev \ imagemagick libmagickwand-dev \ && rm -rf /var/lib/apt/lists/*

Create snorby user¶

RUN useradd -r -m -s /bin/bash snorby

Set working directory¶

WORKDIR /opt/snorby

Clone Snorby¶

RUN git clone https://github.com/Snorby/snorby.git . && \ chown -R snorby:snorby /opt/snorby

Switch to snorby user¶

USER snorby

Install Ruby dependencies¶

RUN bundle install --deployment --without development test

Copy configuration files¶

COPY database.yml config/database.yml COPY snorby_config.yml config/snorby_config.yml

Expose port¶

EXPOSE 3000

Start command¶

CMD ["bundle", "exec", "rails", "server", "-e", "production", "-b", "0.0.0.0"] EOF

Create database configuration for container¶

cat > database.yml << 'EOF' production: adapter: mysql2 database: snorby username: snorby password: snorbypassword host: snorby-mysql port: 3306 encoding: utf8 EOF

Create Snorby configuration for container¶

cat > snorby_config.yml ``<< 'EOF' production: domain: localhost wkhtmltopdf: /usr/bin/wkhtmltopdf ssl: false mailer_sender: snorby@localhost geoip_uri: "http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz" authentication_mode: database EOF

Build and run Snorby container¶

docker build -f Dockerfile.snorby -t snorby .

Wait for MySQL to be ready¶

sleep 30

Run database setup¶

docker run --rm --network snorby-network \ -v $(pwd)/database.yml:/opt/snorby/config/database.yml \ -v $(pwd)/snorby_config.yml:/opt/snorby/config/snorby_config.yml \ snorby bundle exec rake snorby:setup RAILS_ENV=production

Start Snorby container¶

docker run -d --name snorby-app \ --network snorby-network \ -p 3000:3000 \ -v $(pwd)/database.yml:/opt/snorby/config/database.yml \ -v $(pwd)/snorby_config.yml:/opt/snorby/config/snorby_config.yml \ snorby ```_

Manuelle Installation¶

```bash

Install Ruby Version Manager (RVM)¶

curl -sSL https://get.rvm.io|bash -s stable source ~/.rvm/scripts/rvm

Install Ruby 2.7¶

rvm install 2.7.0 rvm use 2.7.0 --default

Install Bundler¶

gem install bundler -v '~>`` 1.17'

Download Snorby¶

git clone https://github.com/Snorby/snorby.git cd snorby

Install dependencies¶

bundle install

Configure database¶

cp config/database.yml.example config/database.yml cp config/snorby_config.yml.example config/snorby_config.yml

Edit configurations as needed¶

nano config/database.yml nano config/snorby_config.yml

Setup database¶

bundle exec rake snorby:setup

Create admin user¶

bundle exec rake snorby:user ```_

Basisnutzung¶

Erstkonfiguration¶

Snorby nach der Installation einrichten:

```bash

Navigate to Snorby directory¶

cd /opt/snorby

Configure Snorby settings¶

sudo -u snorby nano config/snorby_config.yml

Example configuration:¶

cat > config/snorby_config.yml ``<< 'EOF' production: # Domain configuration domain: snorby.company.com

# SSL configuration ssl: true

# Email configuration mailer_sender: snorby@company.com smtp_settings: address: smtp.company.com port: 587 domain: company.com user_name: snorby@company.com password: emailpassword authentication: plain enable_starttls_auto: true

# GeoIP configuration geoip_uri: "http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz"

# Authentication mode authentication_mode: database

# PDF generation wkhtmltopdf: /usr/bin/wkhtmltopdf

# Time zone time_zone: "Eastern Time (US & Canada)"

# Lookups whois_enabled: true reputation_enabled: true

# Performance settings event_page_size: 50 cache_timeout: 300 EOF

Set proper permissions¶

sudo chown snorby:snorby config/snorby_config.yml sudo chmod 600 config/snorby_config.yml

Download GeoIP database¶

sudo -u snorby mkdir -p db/geoip sudo -u snorby wget -O db/geoip/GeoIP.dat.gz \ "http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz" sudo -u snorby gunzip db/geoip/GeoIP.dat.gz

Run database migrations¶

sudo -u snorby bundle exec rake db:migrate RAILS_ENV=production

Precompile assets¶

sudo -u snorby bundle exec rake assets:precompile RAILS_ENV=production ```_

Starten von Snorby¶

Beginn der Snorby Web-Anwendung:

```bash

Start Snorby manually¶

sudo -u snorby -i cd /opt/snorby bundle exec rails server -e production -b 0.0.0.0 -p 3000

Or start in background¶

nohup bundle exec rails server -e production -b 0.0.0.0 -p 3000 >`` log/snorby.log 2>&1 &

Exit Snorby user session¶

exit

Create systemd service¶

sudo cat > /etc/systemd/system/snorby.service ``<< 'EOF' [Unit] Description=Snorby Web Application After=network.target mysql.service

[Service] Type=simple User=snorby Group=snorby WorkingDirectory=/opt/snorby Environment=RAILS_ENV=production ExecStart=/usr/local/bin/bundle exec rails server -e production -b 0.0.0.0 -p 3000 Restart=always RestartSec=10

[Install] WantedBy=multi-user.target EOF

Enable and start service¶

sudo systemctl daemon-reload sudo systemctl enable snorby sudo systemctl start snorby

Check service status¶

sudo systemctl status snorby

View logs¶

sudo journalctl -u snorby -f ```_

Web Interface Zugriff¶

Zugriff und Nutzung der Snorby Web-Schnittstelle:

```bash

Access Snorby web interface¶

Open browser and navigate to:¶

http://your-server-ip:3000 ¶

or¶

https://snorby.company.com (if SSL configured)¶

Username: admin@snorby.org ¶

Password: snorby¶

Check if Snorby is running¶

curl -I http://localhost:3000

Test database connectivity¶

sudo -u snorby -i cd /opt/snorby bundle exec rails console production

In Rails console:¶

User.count¶

Event.count¶

exit¶

Check logs for errors¶

sudo tail -f /opt/snorby/log/production.log ```_

Sensorkonfiguration¶

Sensoren konfigurieren, um Daten an Snorby zu senden:

```bash

Snorby uses the same database as Snort/Barnyard2¶

Configure Barnyard2 to write to Snorby database¶

Example Barnyard2 configuration¶

cat >`` /etc/snort/barnyard2.conf << 'EOF'

Barnyard2 configuration for Snorby¶

Database output¶

output database: log, mysql, user=snorby password=snorbypassword dbname=snorby host=localhost

Syslog output¶

output alert_syslog: LOG_AUTH LOG_ALERT

Unified2 input¶

config reference_file: /etc/snort/reference.config config classification_file: /etc/snort/classification.config config gen_file: /etc/snort/gen-msg.map config sid_file: /etc/snort/sid-msg.map

Processing options¶

config logdir: /var/log/snort config hostname: sensor01 config interface: eth0 config waldo_file: /var/log/snort/barnyard2.waldo

Performance tuning¶

config max_mpls_labelchain_len: 3 config max_ip6_extensions: 4 config addressspace_id: 0 EOF

Start Barnyard2¶

barnyard2 -c /etc/snort/barnyard2.conf -d /var/log/snort -f snort.u2 -w /var/log/snort/barnyard2.waldo -g snort -u snort -D

Verify events are being inserted¶

mysql -u snorby -p snorby -e "SELECT COUNT(*) FROM event;" ```_

Erweiterte Funktionen¶

Individuelles Armaturenbrett¶

Erstellen Sie benutzerdefinierte Dashboards und Widgets:

```ruby

Custom dashboard configuration¶

File: /opt/snorby/app/models/custom_dashboard.rb¶

class CustomDashboard include ActiveModel::Model

def self.security_overview \\{ total_events: Event.count, events_today: Event.where('timestamp >= ?', Date.current.beginning_of_day).count, unique_sources: Event.distinct.count(:src_ip), unique_destinations: Event.distinct.count(:dst_ip), top_signatures: top_signatures(10), hourly_stats: hourly_event_stats, severity_breakdown: severity_breakdown, geographic_stats: geographic_breakdown \\} end

def self.top_signatures(limit = 10) Event.joins(:signature) .group('signature.sig_name') .order('count_all DESC') .limit(limit) .count end

def self.hourly_event_stats Event.where('timestamp >= ?', 24.hours.ago) .group("DATE_FORMAT(timestamp, '%H')") .count end

def self.severity_breakdown Event.joins(:signature) .group('signature.sig_priority') .count end

def self.geographic_breakdown # Requires GeoIP integration Event.joins(:src_ip_geolocation) .group('src_ip_geolocations.country') .limit(20) .count end

def self.threat_intelligence \\{ malware_events: malware_related_events, botnet_activity: botnet_activity, scanning_activity: scanning_activity, brute_force_attempts: brute_force_attempts \\} end

def self.malware_related_events Event.joins(:signature) .where("signature.sig_name LIKE ? OR signature.sig_name LIKE ? OR signature.sig_name LIKE ?", '%trojan%', '%malware%', '%backdoor%') .where('timestamp >= ?', 24.hours.ago) .count end

def self.botnet_activity Event.joins(:signature) .where("signature.sig_name LIKE ? OR signature.sig_name LIKE ?", '%botnet%', '%c2%') .where('timestamp >= ?', 24.hours.ago) .count end

def self.scanning_activity Event.joins(:signature) .where("signature.sig_name LIKE ? OR signature.sig_name LIKE ?", '%scan%', '%probe%') .where('timestamp >= ?', 24.hours.ago) .count end

def self.brute_force_attempts Event.joins(:signature) .where("signature.sig_name LIKE ? OR signature.sig_name LIKE ?", '%brute%', '%login%') .where('timestamp >= ?', 24.hours.ago) .count end end ```_

Advanced Analytics¶

Erstellung fortschrittlicher Analysen und Korrelationsregeln:

```ruby

Advanced analytics engine¶

File: /opt/snorby/lib/analytics_engine.rb¶

class AnalyticsEngine def self.detect_anomalies \\{ traffic_anomalies: detect_traffic_anomalies, behavioral_anomalies: detect_behavioral_anomalies, temporal_anomalies: detect_temporal_anomalies \\} end

def self.detect_traffic_anomalies # Detect unusual traffic patterns current_hour_events = Event.where('timestamp >= ?', 1.hour.ago).count average_hourly_events = Event.where('timestamp >= ?', 7.days.ago) .group("DATE_FORMAT(timestamp, '%H')") .average(:count) .values.sum / 24

anomalies = []

if current_hour_events > (average_hourly_events * 2)
  anomalies << \\\\{
    type: 'high_traffic_volume',
    severity: 'warning',
    description: "Current hour events (#\\\\{current_hour_events\\\\}) significantly higher than average (#\\\\{average_hourly_events.round\\\\})",
    timestamp: Time.current
  \\\\}
end

# Detect port scanning
port_scan_sources = Event.where('timestamp >= ?', 1.hour.ago)
                        .group(:src_ip)
                        .having('COUNT(DISTINCT dst_port) > ?', 20)
                        .count

| | port_scan_sources.each do | src_ip, port_count | | | anomalies << \\{ type: 'port_scanning', severity: 'high', description: "Source #\\{src_ip\\} accessed #\\{port_count\\} different ports in the last hour", src_ip: src_ip, timestamp: Time.current \\} end

anomalies

end

def self.detect_behavioral_anomalies anomalies = []

# Detect unusual source behavior
unusual_sources = Event.where('timestamp >= ?', 24.hours.ago)
                      .group(:src_ip)
                      .having('COUNT(*) > ?', 1000)
                      .count

| | unusual_sources.each do | src_ip, event_count | | | anomalies << \\{ type: 'unusual_source_activity', severity: 'medium', description: "Source #\\{src_ip\\} generated #\\{event_count\\} events in 24 hours", src_ip: src_ip, timestamp: Time.current \\} end

# Detect beaconing behavior
beaconing_sources = detect_beaconing_behavior

| | beaconing_sources.each do | src_ip, intervals | | | anomalies << \\{ type: 'beaconing_behavior', severity: 'high', description: "Source #\\{src_ip\\} shows regular communication intervals (potential C2)", src_ip: src_ip, intervals: intervals, timestamp: Time.current \\} end

anomalies

end

def self.detect_beaconing_behavior # Simplified beaconing detection # Look for regular communication intervals beaconing_sources = \\{\\}

Event.where('timestamp >= ?', 24.hours.ago)
     .group(:src_ip, :dst_ip)
     .having('COUNT(*) > ?', 10)
     .pluck(:src_ip, :dst_ip)

  events = Event.where(src_ip: src_ip, dst_ip: dst_ip)
               .where('timestamp >= ?', 24.hours.ago)
               .order(:timestamp)
               .pluck(:timestamp)

  if events.length > 10
    intervals = []

    # Check for regular intervals (simplified)
    avg_interval = intervals.sum / intervals.length

| | variance = intervals.map \\{ | i | (i - avg_interval) ** 2 \\}.sum / intervals.length | |

    if variance < (avg_interval * 0.1) # Low variance indicates regular intervals
      beaconing_sources[src_ip] = \\\\{
        dst_ip: dst_ip,
        avg_interval: avg_interval,
        variance: variance,
        event_count: events.length
      \\\\}
    end
  end
end

beaconing_sources

end

def self.detect_temporal_anomalies anomalies = []

# Detect unusual activity during off-hours
current_hour = Time.current.hour

| | if (current_hour < 6 | | current_hour > 22) # Off-hours | | off_hours_events = Event.where('timestamp >= ?', 1.hour.ago).count normal_hours_avg = Event.where('timestamp >= ? AND timestamp < ?', 7.days.ago, Time.current) .where('HOUR(timestamp) BETWEEN ? AND ?', 6, 22) .count / (7 * 16) # 7 days, 16 hours per day

  if off_hours_events > (normal_hours_avg * 1.5)
    anomalies << \\\\{
      type: 'off_hours_activity',
      severity: 'medium',
      description: "Unusual activity during off-hours: #\\\\{off_hours_events\\\\} events (normal: #\\\\{normal_hours_avg.round\\\\})",
      timestamp: Time.current
    \\\\}
  end
end

anomalies

end

def self.generate_threat_report \\{ timestamp: Time.current, anomalies: detect_anomalies, threat_indicators: extract_threat_indicators, recommendations: generate_recommendations \\} end

def self.extract_threat_indicators indicators = []

# Extract IOCs from recent events
recent_events = Event.includes(:signature)
                    .where('timestamp >= ?', 24.hours.ago)
                    .where("signature.sig_name LIKE ? OR signature.sig_name LIKE ?",
                           '%malware%', '%trojan%')

| | recent_events.each do | event | | | indicators << \\{ type: 'ip_address', value: event.src_ip, context: event.signature.sig_name, timestamp: event.timestamp, confidence: calculate_confidence(event) \\} end

| | indicators.uniq \\{ | i | [i[:type], i[:value]] \\} | | end

def self.calculate_confidence(event) # Simplified confidence calculation base_confidence = 50

# Increase confidence based on signature priority
if event.signature.sig_priority <= 2
  base_confidence += 30
elsif event.signature.sig_priority <= 3
  base_confidence += 20
end

# Increase confidence if multiple events from same source
same_source_events = Event.where(src_ip: event.src_ip)
                         .where('timestamp >= ?', 24.hours.ago)
                         .count

if same_source_events > 10
  base_confidence += 20
end

[base_confidence, 100].min

end

def self.generate_recommendations recommendations = []

anomalies = detect_anomalies

| | anomalies.values.flatten.each do | anomaly | | | case anomaly[:type] when 'port_scanning' recommendations << \\{ priority: 'high', action: 'block_ip', target: anomaly[:src_ip], description: "Consider blocking source IP #\\{anomaly[:src_ip]\\} due to port scanning activity" \\} when 'beaconing_behavior' recommendations << \\{ priority: 'high', action: 'investigate', target: anomaly[:src_ip], description: "Investigate potential C2 communication from #\\{anomaly[:src_ip]\\}" \\} when 'high_traffic_volume' recommendations << \\{ priority: 'medium', action: 'monitor', description: "Monitor network for potential DDoS or scanning activity" \\} end end

recommendations

end end ```_

Automatisierte Meldung¶

Erstellung automatisierter Reporting-Funktionen:

```ruby

Automated reporting system¶

File: /opt/snorby/lib/automated_reporter.rb¶

class AutomatedReporter def self.generate_daily_report(date = Date.current) report_data = \\{ date: date, summary: daily_summary(date), top_events: top_events(date), geographic_analysis: geographic_analysis(date), threat_analysis: threat_analysis(date), recommendations: daily_recommendations(date) \\}

html_report = generate_html_report(report_data, 'daily')
pdf_report = generate_pdf_report(html_report)

# Save reports
save_report(html_report, "daily_#\\\\{date.strftime('%Y%m%d')\\\\}.html")
save_report(pdf_report, "daily_#\\\\{date.strftime('%Y%m%d')\\\\}.pdf")

# Email report if configured
email_report(html_report, "Daily Security Report - #\\\\{date\\\\}")

report_data

end

def self.generate_weekly_report(week_start = Date.current.beginning_of_week) week_end = week_start.end_of_week

report_data = \\\\{
  week_start: week_start,
  week_end: week_end,
  summary: weekly_summary(week_start, week_end),
  trends: weekly_trends(week_start, week_end),
  top_threats: weekly_top_threats(week_start, week_end),
  performance_metrics: weekly_performance(week_start, week_end)
\\\\}

html_report = generate_html_report(report_data, 'weekly')
save_report(html_report, "weekly_#\\\\{week_start.strftime('%Y%m%d')\\\\}_#\\\\{week_end.strftime('%Y%m%d')\\\\}.html")

report_data

end

def self.daily_summary(date) start_time = date.beginning_of_day end_time = date.end_of_day

\\\\{
  total_events: Event.where(timestamp: start_time..end_time).count,
  unique_sources: Event.where(timestamp: start_time..end_time).distinct.count(:src_ip),
  unique_destinations: Event.where(timestamp: start_time..end_time).distinct.count(:dst_ip),
  high_priority_events: Event.joins(:signature)
                            .where(timestamp: start_time..end_time)
                            .where('signature.sig_priority <= ?', 2)
                            .count,
  blocked_events: Event.where(timestamp: start_time..end_time)
                      .where(blocked: true)
                      .count
\\\\}

end

def self.top_events(date, limit = 20) start_time = date.beginning_of_day end_time = date.end_of_day

Event.joins(:signature)
     .where(timestamp: start_time..end_time)
     .group('signature.sig_name')
     .order('count_all DESC')
     .limit(limit)
     .count

end

def self.geographic_analysis(date) # Requires GeoIP integration start_time = date.beginning_of_day end_time = date.end_of_day

# Simplified geographic analysis
Event.where(timestamp: start_time..end_time)
     .group(:src_ip)
     .having('COUNT(*) > ?', 10)
     .count

| | .transform_keys \\{ | ip | geolocate_ip(ip) \\} | | | | .group_by \\{ | location, count | location[:country] \\} | | | | .transform_values \\{ | entries | entries.sum \\{ | _, count | count \\} \\} | | end

def self.threat_analysis(date) start_time = date.beginning_of_day end_time = date.end_of_day

\\\\{
  malware_events: Event.joins(:signature)
                      .where(timestamp: start_time..end_time)
                      .where("signature.sig_name LIKE ?", '%malware%')
                      .count,
  scanning_events: Event.joins(:signature)
                       .where(timestamp: start_time..end_time)
                       .where("signature.sig_name LIKE ?", '%scan%')
                       .count,
  brute_force_events: Event.joins(:signature)
                          .where(timestamp: start_time..end_time)
                          .where("signature.sig_name LIKE ?", '%brute%')
                          .count,
  c2_events: Event.joins(:signature)
                 .where(timestamp: start_time..end_time)
                 .where("signature.sig_name LIKE ? OR signature.sig_name LIKE ?",
                        '%c2%', '%command%')
                 .count
\\\\}

end

def self.generate_html_report(data, type) template = ERB.new(File.read("app/views/reports/#\\{type\\}_template.html.erb")) template.result(binding) end

def self.generate_pdf_report(html_content) # Requires wkhtmltopdf pdf_file = Tempfile.new(['report', '.pdf'])

system("echo '#\\\\{html_content\\\\}'|wkhtmltopdf - #\\\\{pdf_file.path\\\\}")

File.read(pdf_file.path)

ensure pdf_file.close pdf_file.unlink end

def self.save_report(content, filename) reports_dir = Rails.root.join('public', 'reports') FileUtils.mkdir_p(reports_dir)

File.write(reports_dir.join(filename), content)

end

def self.email_report(html_content, subject) return unless Rails.application.config.action_mailer.delivery_method

ReportMailer.security_report(html_content, subject).deliver_now

end

def self.geolocate_ip(ip) # Simplified geolocation - integrate with actual GeoIP service \\{ ip: ip, country: 'Unknown', city: 'Unknown', latitude: 0, longitude: 0 \\} end end

Mailer for reports¶

File: /opt/snorby/app/mailers/report_mailer.rb¶

class ReportMailer ``< ApplicationMailer def security_report(html_content, subject) @content = html_content

mail(
  to: Rails.application.config.security_email,
  subject: subject,
  content_type: 'text/html'
)

end end ```_

Automatisierungsskripte¶

Umfassendes Monitoring-Script¶

```bash

!/bin/bash¶

Comprehensive Snorby monitoring and maintenance¶

Configuration¶

SNORBY_DIR="/opt/snorby" LOG_DIR="/var/log/snorby" BACKUP_DIR="/var/backups/snorby" PID_FILE="/var/run/snorby.pid"

Database configuration¶

DB_HOST="localhost" DB_USER="snorby" DB_PASS="snorbypassword" DB_NAME="snorby"

Monitoring thresholds¶

MAX_RESPONSE_TIME="10" MAX_MEMORY_USAGE="80" MAX_DISK_USAGE="90"

Create necessary directories¶

mkdir -p "$LOG_DIR" "$BACKUP_DIR"

Logging function¶

log_message() \{ echo "$(date '+%Y-%m-%d %H:%M:%S') - $1"|tee -a "$LOG_DIR/monitor.log" \}

Check Snorby web application¶

check_web_application() \{ log_message "Checking Snorby web application..."

local response_time
response_time=$(curl -o /dev/null -s -w '%\\\{time_total\\\}' http://localhost:3000/ 2>``/dev/null)

if [ $? -eq 0 ]; then
    log_message "Web application is accessible (response time: $\\\\{response_time\\\\}s)"

    # Check if response time is acceptable
    if (( $(echo "$response_time > $MAX_RESPONSE_TIME"|bc -l) )); then
        log_message "WARNING: Slow response time: $\\\\{response_time\\\\}s (threshold: $\\\\{MAX_RESPONSE_TIME\\\\}s)"
        return 1
    fi

    return 0
else
    log_message "ERROR: Web application is not accessible"
    return 1
fi

\\}

Check Snorby process¶

check_snorby_process() \\{ log_message "Checking Snorby process..."

if systemctl is-active --quiet snorby; then
    log_message "Snorby service is running"

    # Check memory usage
    local memory_usage

    if [ -n "$memory_usage" ] && (( $(echo "$memory_usage > $MAX_MEMORY_USAGE"|bc -l) )); then
        log_message "WARNING: High memory usage: $\\\\{memory_usage\\\\}% (threshold: $\\\\{MAX_MEMORY_USAGE\\\\}%)"
    fi

    return 0
else
    log_message "ERROR: Snorby service is not running"
    return 1
fi

\\}

Check database connectivity¶

check_database() \\{ log_message "Checking database connectivity..."

mysql -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASS" "$DB_NAME" -e "SELECT 1;" >/dev/null 2>&1

if [ $? -eq 0 ]; then
    log_message "Database connection successful"

    # Check recent events
    local recent_events
    recent_events=$(mysql -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASS" "$DB_NAME" -N -e "
        SELECT COUNT(*) FROM event WHERE timestamp >= DATE_SUB(NOW(), INTERVAL 1 HOUR);
    " 2>/dev/null)

    log_message "Recent events (last hour): $recent_events"

    # Check database size
    local db_size
    db_size=$(mysql -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASS" "$DB_NAME" -N -e "
        SELECT ROUND(SUM(data_length + index_length) / 1024 / 1024, 2) AS 'DB Size in MB'
        FROM information_schema.tables
        WHERE table_schema='$DB_NAME';
    " 2>/dev/null)

    log_message "Database size: $\\\\{db_size\\\\} MB"

    return 0
else
    log_message "ERROR: Database connection failed"
    return 1
fi

\\}

Check disk space¶

check_disk_space() \\{ log_message "Checking disk space..."

local usage

| | usage=$(df -h "$SNORBY_DIR" | awk 'NR==2 \\{print $5\\}' | sed 's/%//') | |

log_message "Disk usage: $\\\\{usage\\\\}%"

if [ "$usage" -gt "$MAX_DISK_USAGE" ]; then
    log_message "WARNING: High disk usage: $\\\\{usage\\\\}% (threshold: $\\\\{MAX_DISK_USAGE\\\\}%)"
    return 1
fi

return 0

\\}

Check log files¶

check_log_files() \\{ log_message "Checking log files..."

local production_log="$SNORBY_DIR/log/production.log"

if [ -f "$production_log" ]; then
    # Check for recent errors
    local error_count

    if [ "$error_count" -gt 5 ]; then
        log_message "WARNING: High number of errors in production log: $error_count"

        # Show recent errors
        log_message "Recent errors:"

    # Rotate large log files
    local log_size

    if [ "$log_size" -gt 104857600 ]; then # 100MB
        log_message "Rotating large production log file"
        mv "$production_log" "$\\\\{production_log\\\\}.$(date +%Y%m%d-%H%M%S)"
        touch "$production_log"
        chown snorby:snorby "$production_log"
    fi
fi

\\}

Performance optimization¶

optimize_performance() \\{ log_message "Running performance optimization..."

# Clear Rails cache
sudo -u snorby -i << 'EOF'

cd /opt/snorby bundle exec rake tmp:cache:clear RAILS_ENV=production bundle exec rake assets:clean RAILS_ENV=production EOF

# Optimize database
mysql -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASS" "$DB_NAME" -e "
    OPTIMIZE TABLE event;
    OPTIMIZE TABLE signature;
    ANALYZE TABLE event;
    ANALYZE TABLE signature;
" >/dev/null 2>&1

# Clean old sessions
mysql -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASS" "$DB_NAME" -e "
    DELETE FROM sessions WHERE updated_at < DATE_SUB(NOW(), INTERVAL 7 DAY);
" >/dev/null 2>&1

log_message "Performance optimization completed"

\\}

Backup Snorby¶

backup_snorby() \\{ log_message "Backing up Snorby..."

local backup_file="$BACKUP_DIR/snorby-backup-$(date +%Y%m%d-%H%M%S).tar.gz"

# Backup application files and database
(
    cd /opt
    tar -czf "$backup_file" \
        snorby/config/ \
        snorby/db/migrate/ \
        snorby/public/uploads/ \
        2>/dev/null
)

# Backup database
mysqldump -h "$DB_HOST" -u "$DB_USER" -p"$DB_PASS" "$DB_NAME"|\
    gzip > "$BACKUP_DIR/snorby-db-$(date +%Y%m%d-%H%M%S).sql.gz"

if [ $? -eq 0 ]; then
    log_message "Backup created: $backup_file"

    # Keep only last 7 days of backups
    find "$BACKUP_DIR" -name "snorby-*.tar.gz" -mtime +7 -delete
    find "$BACKUP_DIR" -name "snorby-db-*.sql.gz" -mtime +7 -delete

    return 0
else
    log_message "ERROR: Backup failed"
    return 1
fi

\\}

Restart Snorby service¶

restart_snorby() \\{ log_message "Restarting Snorby service..."

systemctl restart snorby

# Wait for service to start
sleep 10

if systemctl is-active --quiet snorby; then
    log_message "Snorby service restarted successfully"
    return 0
else
    log_message "ERROR: Failed to restart Snorby service"
    return 1
fi

\\}

Generate health report¶

generate_health_report() \\{ log_message "Generating health report..."

local report_file="$LOG_DIR/health-report-$(date +%Y%m%d-%H%M%S).html"

cat > "$report_file" << EOF

Snorby Health Report

Generated: $(date)

System Status

EOF # Check each component and add to report if check_web_application >/dev/null 2>&1; then echo " " >> "$report_file" else echo " " >> "$report_file" fi if check_snorby_process >/dev/null 2>&1; then echo " " >> "$report_file" else echo " " >> "$report_file" fi if check_database >/dev/null 2>&1; then echo " " >> "$report_file" else echo " " >> "$report_file" fi local disk_usage disk_usage=$(df -h "$SNORBY_DIR"|awk 'NR==2 \\\\{print $5\\\\}') echo " " >> "$report_file" cat >> "$report_file" << EOF

Component	Status	Details
Web Application	OK	Accessible
Web Application	ERROR	Not accessible
Snorby Process	OK	Running
Snorby Process	ERROR	Not running
Database	OK	Connected
Database	ERROR	Connection failed
Disk Space	OK	Usage: $disk_usage

Recent Activity

| |

$(tail -n 20 "$LOG_DIR/monitor.log" 2>/dev/null |  | echo "No recent activity logged")

| |

EOF

log_message "Health report generated: $report_file"

\\}

Send alert notification¶

send_alert() \\{ local subject="$1" local message="$2"

# Send email if mail is configured
if command -v mail >/dev/null 2>&1; then
    echo "$message"|mail -s "Snorby Alert: $subject" security@company.com
fi

# Log to syslog
logger -t snorby-monitor "$subject: $message"

log_message "Alert sent: $subject"

\\}

Main monitoring function¶

run_monitoring() \\{ log_message "Starting Snorby monitoring cycle"

local issues=0

# Run all checks

# Performance optimization (weekly)
if [ "$(date +%u)" -eq 1 ] && [ "$(date +%H)" -eq 2 ]; then
    optimize_performance
    backup_snorby
fi

# Generate health report (daily)
if [ "$(date +%H)" -eq 6 ]; then
    generate_health_report
fi

# Restart service if issues detected
if [ "$issues" -gt 2 ]; then
    log_message "Multiple issues detected, attempting service restart"
    restart_snorby
fi

# Send alerts if issues found
if [ "$issues" -gt 0 ]; then
    send_alert "System Issues Detected" "Found $issues issues during monitoring. Check logs for details."
fi

log_message "Monitoring cycle completed with $issues issues"
return $issues

\\}

Command line interface¶

case "$\\{1:-monitor\\}" in "monitor") run_monitoring ;; "restart") restart_snorby ;; "backup") backup_snorby ;; "optimize") optimize_performance ;; "report") generate_health_report ;; *) | | echo "Usage: $0 \\{monitor | restart | backup | optimize | report\\}" | | echo "" echo "Commands:" echo " monitor - Run complete monitoring cycle (default)" echo " restart - Restart Snorby service" echo " backup - Backup Snorby application and database" echo " optimize - Run performance optimization" echo " report - Generate health report" exit 1 ;; esac ```_

Integrationsbeispiele¶

SIEM Integration¶

```ruby

SIEM integration for Snorby¶

File: /opt/snorby/lib/siem_integration.rb¶

class SiemIntegration def self.export_to_splunk(time_range = 1.hour) events = Event.includes(:signature) .where('timestamp >= ?', time_range.ago)

| | events.find_each do | event | | | splunk_event = \\{ time: event.timestamp.to_i, source: 'snorby', sourcetype: 'snort:alert', index: 'security', event: \\{ sid: event.sid, cid: event.cid, signature: event.signature.sig_name, signature_id: event.signature.sig_id, src_ip: event.src_ip, src_port: event.src_port, dst_ip: event.dst_ip, dst_port: event.dst_port, protocol: event.ip_proto, priority: event.signature.sig_priority, classification: event.signature.sig_class_id \\} \\}

  send_to_splunk_hec(splunk_event)
end

end

def self.send_to_splunk_hec(event_data) uri = URI(Rails.application.config.splunk_hec_url) http = Net::HTTP.new(uri.host, uri.port) http.use_ssl = true if uri.scheme == 'https'

request = Net::HTTP::Post.new(uri)
request['Authorization'] = "Splunk #\\\\{Rails.application.config.splunk_hec_token\\\\}"
request['Content-Type'] = 'application/json'
request.body = event_data.to_json

response = http.request(request)

unless response.code == '200'
  Rails.logger.error "Failed to send event to Splunk: #\\\\{response.code\\\\} #\\\\{response.body\\\\}"
end

end

def self.export_to_elasticsearch(time_range = 1.hour) events = Event.includes(:signature) .where('timestamp >= ?', time_range.ago)

| | events.find_each do | event | | | es_event = \\{ '@timestamp' => event.timestamp.iso8601, source: \\{ ip: event.src_ip, port: event.src_port \\}, destination: \\{ ip: event.dst_ip, port: event.dst_port \\}, network: \\{ protocol: protocol_name(event.ip_proto) \\}, event: \\{ id: "#\\{event.sid\\}-#\\{event.cid\\}", category: 'network', type: 'alert', severity: severity_level(event.signature.sig_priority) \\}, rule: \\{ id: event.signature.sig_id, name: event.signature.sig_name, category: event.signature.sig_class_id \\} \\}

  send_to_elasticsearch(es_event)
end

end

def self.send_to_elasticsearch(event_data) index_name = "snorby-#\\{Date.current.strftime('%Y.%m.%d')\\}" doc_id = event_data[:event][:id]

uri = URI("#\\\\{Rails.application.config.elasticsearch_url\\\\}/#\\\\{index_name\\\\}/_doc/#\\\\{doc_id\\\\}")
http = Net::HTTP.new(uri.host, uri.port)

request = Net::HTTP::Put.new(uri)
request['Content-Type'] = 'application/json'
request.body = event_data.to_json

response = http.request(request)

unless ['200', '201'].include?(response.code)
  Rails.logger.error "Failed to send event to Elasticsearch: #\\\\{response.code\\\\} #\\\\{response.body\\\\}"
end

end

private

def self.protocol_name(proto_num) case proto_num when 1 then 'icmp' when 6 then 'tcp' when 17 then 'udp' else proto_num.to_s end end

def self.severity_level(priority) case priority when 1..2 then 'high' when 3..4 then 'medium' else 'low' end end end ```_

Fehlerbehebung¶

Gemeinsame Themen¶

Application Wird nicht gestartet: ```bash

Check Ruby version¶

ruby --version

Check Bundler¶

bundle --version

Check dependencies¶

cd /opt/snorby bundle check

Install missing dependencies¶

bundle install

Check database configuration¶

cat config/database.yml

Test database connection¶

bundle exec rails console production

In console: ActiveRecord::Base.connection.active?¶

Check logs¶

tail -f log/production.log ```_

** Probleme der Datenbankverbindung:** ```bash

Test MySQL connection¶

mysql -u snorby -p snorby -e "SELECT COUNT(*) FROM event;"

Check database permissions¶

mysql -u root -p -e "SHOW GRANTS FOR 'snorby'@'localhost';"

Verify database exists¶

mysql -u root -p -e "SHOW DATABASES;"|grep snorby

Check MySQL service¶

sudo systemctl status mysql ```_

Leistungsfragen: ```bash

Check system resources¶

top -p $(pgrep -f "rails server") free -h df -h

Check database performance¶

mysql -u snorby -p snorby -e "SHOW PROCESSLIST;"

Optimize database¶

mysql -u snorby -p snorby -e "OPTIMIZE TABLE event; OPTIMIZE TABLE signature;"

Clear Rails cache¶

cd /opt/snorby sudo -u snorby bundle exec rake tmp:cache:clear RAILS_ENV=production ```_

Leistungsoptimierung¶

Optimierung der Snorby-Leistung:

```bash

Ruby/Rails optimization¶

cat >> /opt/snorby/config/environments/production.rb << 'EOF'

Performance optimizations¶

config.cache_classes = true config.eager_load = true config.consider_all_requests_local = false config.action_controller.perform_caching = true config.cache_store = :memory_store, \\{ size: 64.megabytes \\} config.assets.compile = false config.assets.digest = true config.log_level = :warn EOF

Database optimization¶

mysql -u root -p << 'EOF' -- Optimize Snorby database USE snorby;

-- Add indexes for common queries CREATE INDEX idx_event_timestamp ON event (timestamp); CREATE INDEX idx_event_src_ip_timestamp ON event (src_ip, timestamp); CREATE INDEX idx_event_dst_ip_timestamp ON event (dst_ip, timestamp); CREATE INDEX idx_event_signature_timestamp ON event (sig_id, timestamp);

-- Optimize tables OPTIMIZE TABLE event; OPTIMIZE TABLE signature; ANALYZE TABLE event; ANALYZE TABLE signature; EOF

System optimization¶

echo "vm.swappiness=10" >> /etc/sysctl.conf sysctl -p ```_

Sicherheitsüberlegungen¶

Zugriffskontrolle¶

Web Application Security: - HTTPS implementieren für alle Snorby-Zugriffe - Verwenden Sie starke Authentifizierungsmechanismen - Durchführung von Sitzungszeiten und Management - Regelmäßige Sicherheitsupdates für Ruby und Rails - Überwachen Sie Zugriffsprotokolle für verdächtige Aktivität

** Datenbanksicherheit:** - Verwenden Sie dedizierte Datenbankbenutzer mit minimalen Privilegien - Implementierung der Datenbank-Verbindung Verschlüsselung - Regelmäßige Aktualisierung der Datenbanksicherheit - Datenbankzugriffsprotokolle überwachen - Implementierung der Backup-Verschlüsselung

Datenschutz¶

Ereignisse Datensicherheit: - Verschlüsseln Sie sensible Ereignisdaten im Ruhezustand - Umsetzung von Datenschutzbestimmungen - Sicherer Zugriff auf Paketerfassungsdaten - Regelmäßige Reinigung von temporären Dateien - Implementierung der Zugangsprotokollierung für Ereignisdaten

** Sicherheit:** - Regelmäßige Sicherheitsbewertungen der Snorby-Infrastruktur - Monitor für unberechtigte Zugriffsversuche - Durchführung richtiger Backup- und Recovery-Verfahren - Regelmäßige Aktualisierungen von Snorby und Abhängigkeiten - Incident Response Verfahren für Snorby Kompromiss