# Path: fjospidie/Utils.py
# def geoip(ip):
#     """
#     Lookup GeoIP information on ip
#     """
#     r = "/usr/share/GeoIP"
#     if not os.path.exists(r):
#         logging.error("GeoIP not found at {}".format(r))
#         return
# 
#     gorg = pygeoip.GeoIP('{}/GeoIPASNum.dat'.format(r))
#     gcity = pygeoip.GeoIP('{}/GeoIPCity.dat'.format(r))
# 
#     data = {}
#     data = gcity.record_by_addr(ip)
#     if data:
#         data['organisation'] = gorg.org_by_addr(ip)
#         data['isp'] = gorg.isp_by_addr(ip)
#     else:
#         print "WTF: {} is null!".format(ip)
#     return data


import logging
import re
from netaddr import IPNetwork, IPAddress, AddrFormatError
from fjospidie.Utils import geoip

class SuricataAlert(object):
    """
    Class representing a fast alert from Suricata
    """

    def __init__(self, alert, httplog, config):
        self.__config = config
        regex = r"(\S+)  \[\*\*\] \[(\d+):(\d+):(\d+)\] (.*?) \[\*\*\] \[Classification: (.*?)\] \[Priority: (\d+)\] {\S+} (.*?):(\d+) -> (.*?):(\d+)"
        matcher = re.compile(regex)
        result = matcher.match(alert)
        self.logger = logging.getLogger(__name__)

        self.time = result.group(1)
        self.gid = result.group(2)
        self.sid = result.group(3)
        self.rule_revision = result.group(4)
        self.alarm_text = result.group(5)
        self.classification = result.group(6)
        self.priority = int(result.group(7))
        self.src = "{}:{}".format(result.group(8), result.group(9))
        self.dst = "{}:{}".format(result.group(10), result.group(11))
        self.src_geoip = geoip(result.group(8))

# Path: fjospidie/Utils.py
# def geoip(ip):
#     """
#     Lookup GeoIP information on ip
#     """
#     r = "/usr/share/GeoIP"
#     if not os.path.exists(r):
#         logging.error("GeoIP not found at {}".format(r))
#         return
# 
#     gorg = pygeoip.GeoIP('{}/GeoIPASNum.dat'.format(r))
#     gcity = pygeoip.GeoIP('{}/GeoIPCity.dat'.format(r))
# 
#     data = {}
#     data = gcity.record_by_addr(ip)
#     if data:
#         data['organisation'] = gorg.org_by_addr(ip)
#         data['isp'] = gorg.isp_by_addr(ip)
#     else:
#         print "WTF: {} is null!".format(ip)
#     return data


# Path: fjospidie/engine/suricata/SuricataAlert.py
import logging
import re
from netaddr import IPNetwork, IPAddress, AddrFormatError
from fjospidie.Utils import geoip


class SuricataAlert(object):
    """
    Class representing a fast alert from Suricata
    """

    def __init__(self, alert, httplog, config):
        self.__config = config
        regex = r"(\S+)  \[\*\*\] \[(\d+):(\d+):(\d+)\] (.*?) \[\*\*\] \[Classification: (.*?)\] \[Priority: (\d+)\] {\S+} (.*?):(\d+) -> (.*?):(\d+)"
        matcher = re.compile(regex)
        result = matcher.match(alert)
        self.logger = logging.getLogger(__name__)

        self.time = result.group(1)
        self.gid = result.group(2)
        self.sid = result.group(3)
        self.rule_revision = result.group(4)
        self.alarm_text = result.group(5)
        self.classification = result.group(6)
        self.priority = int(result.group(7))
        self.src = "{}:{}".format(result.group(8), result.group(9))
        self.dst = "{}:{}".format(result.group(10), result.group(11))
        self.src_geoip = geoip(result.group(8))

        self.dst_geoip = geoip(result.group(10))