Lilith
Lilith reads in EVE files from Suricata and Sagan into PostgreSQL.
From there that data can then be searched and information on specific events fetched.
Intalation
Debian
apt-get install zlib1g-dev cpanminus libjson-perl libtoml-perl \
libdbi-perl libfile-readbackwards-perl libdigest-sha-perl libpoe-perl \
libfile-slurp-perl libdbd-pg-perl
cpanm Lilith
FreeBSD
pkg install p5-App-cpanminus p5-JSON p5-TOML p5-DBI \
p5-File-ReadBackwards p5-Digest-SHA p5-POE \
p5-MIME-Base64 p5-Gzip-Faster p5-DBD-Pg p5-File-Slurp
cpanm Lilith
Source
perl Makefile.PL
make
make test
make install
Setup
First you need to setup your PostgreSQL server.
createuser -D -l -P -R -S lilith
createdb -E UTF8 -O lilith lilith
Setup /usr/local/etc/lilith.toml
dsn="dbi:Pg:dbname=lilith;host=192.168.1.2"
pass="WhateverYouSetAsApassword"
user="lilith"
# a handy one to ignore for the extend as it is spammy
class_ignore=["Generic Protocol Command Decode"]
# add a suricata instance to monitor
[suricata-eve]
instance="foo-pie"
type="suricata"
eve="/var/log/suricata/alert.json"
# add a second suricata instance to monitor
[another-eve]
instance="foo2-pie"
type="suricata"
eve="/var/log/suricata/alert2.json"
# add a sagan eve to monitor
# instance name is 'foo-lae', given there is no value for instance
[foo-lae]
type="sagan"
eve="/var/log/sagan/alert.json"
Now we just need to setup the tables.
lilith -a create_tables
If using snmpd.
extend lilith /usr/local/bin/lilith -a extend
Config File
The default config file is /usr/local/etc/lilith.toml.
| Variable | Description | |--------------|------------------------------------------------------------------------------------------------------------------------| | dsn | A DSN connection string to be used by [DBI][https://metacpan.org/pod/DBI]. [DBD::Pg][https://metacpan.org/pod/DBD::Pg] | | pass | Password to use for the connection. | | user | User to use for the connetion. | | class_ignore | Array of classes to ignore. |
Sub hashes are then treated as a instance. The following values are available for that.
| Variable | Required | Description |
|----------|----------|--------------------------------------------------------------------|
| eve | yes | The EVE file to follow. |
| type | yes | sagan or suricata, depending on which it is. |
| instance | no | The name for the instance. If not specified the hash name is used. |
Options
SYNOPSIS
lilith [-c <config>] -a run
lilith -a class_map
lilith [-c <config>] -a create_tables
lilith [-c <config>] -a dump_self
lilith [-c <config>] -a event [-t <table>] --id <row_id> [--raw] [[--virani <remote>] [--pcap <output file>] [--buffer <buffer secodns>]]
lilith [-c <config>] -a event [-t <table>] --event <event_id> [--raw] [[--virani <remote>] [--pcap <output file>] [--buffer <buffer secodns>]]
lilith [-c <config>] -a extend [-Z] [-m <minutes>]
lilith -a generate_baphomet_yamls --dir <dir>
lilith [-c <config>] -a get_short_class_snmp_list
lilith [-c <config>] -a search [--output <return>] [-t <table>] [-m <minutes>] [--order <clm>] [--limit <int>] [--offset <int>] [--orderdir <dir>] [--si <src_ip>] [--di <dst_ip>] [--ip <ip>] [--sp <src_port>] [--dp <dst_port>] [--port <port>] [--host <host>] [--hostl] [--hosN] [--ih <host>] [--ihl] [--ihN] [-i <instance>] [-il] [-iN] [-c <class>] [--cl] [--cN] [-s <sig>] [--sl] [--sN] [--if <if>] [--ifl] [--ifN] [--ap <proto>] [--apl] [--apN] [--gid <gid>] [--sid <sid>] [--rev <rev>]
GENERAL SWITCHES
-a
The action to perform.
- Default :: search
-c
The config file to use.
- Default :: /usr/local/etc/lilith.toml