Skip to content

Commit eabc93f

Browse files
mlodicmlodic
authored
first version (#1)
* Django skeleton * Create LICENSE * draft first version * +x entrypoint * support for elastic endpoint backups * support for elastic endpoint backups * psycopg * mkdir -p * nginx cache * psycopg2-binary * psycopg-binary * psycopg-binary * psycopg * buster? * psycopg2 * psycopg2 * added basic feeds API * adjusts * admin adjust * added initial migration * add init to migrations * logs fix * adjust tests * debug log * elasticsearch logs * fixed honeypot name * fixed honeypot name * fix attacks extraction * first * adjusts * managed unique fields * adjusts to web server * adjust * adjust * removed unique constraint * adjustments fks * sensors initialization * correct now * added wait-for-it.sh * waitforit * fix dockerfile * typo * added inits * removing time zones * adjusted urls * added nginx logrotate * more log * adjusted celery * correlation id * urls * fix urls * fix view * fix view * fix models and apis * adjust admin * adjusted url * adjust favicon * favicon * fix * adjust celery and dates * adjust date and logs * adjust logs * trying fixing arrays * removed migration + readded logger * added migration * again trying to fix array fields * manage arrays * m-2-m + readme * added new migration * fix * watched log file + fix m2m * fixed model * corrected migration * adjust again * removing many to many rels * admin fix * added migration * adjusted view * adjusted json output
1 parent 46d4dd6 commit eabc93f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

50 files changed

+1628
-0
lines changed

‎.env_template‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
COMPOSE_FILE=docker/default.yml

‎.flake8‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
[flake8]
2+
max-line-length = 105
3+
ignore =
4+
W503, # line break before binary operator
5+
E231, # missing whitespace after ',' (caused by black style)
6+
W605, # invalid escape sequence (caused by regex)
7+
exclude =
8+
docker,
9+
venv,
10+
docs,
11+
greedybear/regex.py

‎.github/workflows/pull_request_automation.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Pull request automation
2+
3+
on:
4+
pull_request:
5+
branches: [ main, develop ]
6+
7+
jobs:
8+
build:
9+
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- uses: actions/checkout@v2
14+
- name: Set up Python
15+
uses: actions/setup-python@v2
16+
with:
17+
python-version: 3.9
18+
19+
- name: Install Dependencies
20+
run: |
21+
pip3 install --upgrade pip
22+
pip3 install -r test-requirements.txt
23+
24+
- name: Black formatter
25+
run: |
26+
black . --check --diff
27+
28+
- name: Lint with flake8 (PEP8 enforcer + linter)
29+
run: |
30+
flake8 . --config=.flake8 --show-source
31+
32+
- name: isort
33+
run: |
34+
isort . --profile black --filter-files --check-only --diff --skip venv

‎.gitignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
venv/
2+
docs/build
3+
docker/env_file
4+
docker/env_file_postgres
5+
.env

‎.pre-commit-config.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
repos:
2+
- repo: https://github.com/psf/black
3+
rev: 21.11b1
4+
hooks:
5+
- id: black
6+
- repo: https://gitlab.com/pycqa/flake8
7+
rev: 4.0.1
8+
hooks:
9+
- id: flake8
10+
- repo: https://github.com/pycqa/isort
11+
rev: 5.10.1
12+
hooks:
13+
- id: isort
14+
args: ["--profile", "black", "--filter-files", "--skip", "venv", "--skip", "configuration/ldap_config.py"]

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 The Honeynet Project
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,36 @@
11
# GreedyBear
2+
3+
The project goal is to extract data of the attacks detected by a TPOT or a cluster of them and to generate some feeds that can be used to prevent and detect attacks.
4+
5+
## Available Feeds
6+
The feeds are reachable through the following URL:
7+
```
8+
https://<greedybear_site>/api/feeds/<feed_type>/<attack_type>/<age>.<format>
9+
```
10+
11+
The available `feed_type` are:
12+
13+
* `log4j`: attacks detected from the Log4pot.
14+
15+
The available `attack_type` are:
16+
17+
* `scanner`: IP addresses captured by the honeypots while performing attacks
18+
* `payload_request`: IP addresses and domains extracted from payloads that would have been executed after a speficic attack would have been successful
19+
20+
The available `age` are:
21+
22+
* `recent`: most recent IOCs seen in the last 3 days
23+
* `persistent`: these IOCs are the ones that were seen regularly by the honeypots. This feeds will start empty once no prior data was collected and will become bigger over time.
24+
25+
The available `format` are:
26+
27+
* `csv`: CSV-like file (just one line for each IOC)
28+
* `json`: JSON file with additional information regarding the IOCs
29+
30+
## Public feeds
31+
32+
There are public feeds provided by The Honeynet Project in this site: greedybear.honeynet.org. [Example](https://greedybear.honeynet.org/api/feeds/log4j/all/recent.csv)
33+
34+
Please do not perform too many requests to extract feeds or you will be banned.
35+
36+
If you want to be updated regularly, please download the feeds only once every 10 minutes (this is the time between each internal update).

‎api/__init__.py‎

Whitespace-only changes.

‎api/apps.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
from django.apps import AppConfig
2+
3+
4+
class ApiConfig(AppConfig):
5+
name = "api"

‎api/urls.py‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
from django.urls import path
2+
3+
from api.views import feeds
4+
5+
urlpatterns = [
6+
path("feeds/<str:feed_type>/<str:attack_type>/<str:age>.<str:format_>", feeds),
7+
]

0 commit comments

Comments
 (0)