描述
Hub加载Modify插件报错,插件是作为告警压制使用,使用内置的cacheout库实现告警压制功能,但是加载插件后 plugin.stdout 出现错误情况
plugin.stdout 报错详情
- - - [2022-08-09 15:29:59] "GET /reload HTTP/1.1" 200 862 0.002285
- - - [2022-08-09 15:29:59] "GET /reload HTTP/1.1" 200 862 0.003835
Traceback (most recent call last):
File "/elkeid/hub/py/pypy/site-packages/gevent/libev/corecffi.py", line 61, in python_prepare_callback
AbstractCallbacks.python_prepare_callback(self, watcher_ptr)
File "/elkeid/hub/py/pypy/site-packages/gevent/_ffi/loop.py", line 302, in python_prepare_callback
loop._run_callbacks()
File "/elkeid/hub/py/pypy/site-packages/gevent/_ffi/loop.py", line 489, in _run_callbacks
while self._callbacks:
KeyboardInterrupt
2022-08-09T15:36:44Z
Traceback (most recent call last):
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib-python/3/runpy.py", line 196, in _run_module_as_main
"__main__", mod_spec)
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib-python/3/runpy.py", line 85, in _run_code
exec(code, run_globals)
File "/elkeid/hub/py/pypy/site-packages/gevent/monkey.py", line 1375, in <module>
main()
File "/elkeid/hub/py/pypy/site-packages/gevent/monkey.py", line 1336, in main
return run_meth(sys.argv[0], run_name='__main__')
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib-python/3/runpy.py", line 266, in run_path
pkg_name=pkg_name, script_name=fname)
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib-python/3/runpy.py", line 96, in _run_module_code
mod_name, mod_spec, pkg_name, script_name)
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib-python/3/runpy.py", line 85, in _run_code
exec(code, run_globals)
File "start.py", line 520, in <module>
gevent.joinall(segJvlkEGVPQtNMVnhSNWbzVfkBHzWnmniAAbbZWwPweUsXvSRJIeADVULGmMTJKIgpQFQnfOCVMiLiJOwDfmPDZFshzwRZShdXaWtrtYoDKGcrvOcABVErtwkEhaVng)
File "/elkeid/hub/py/pypy/site-packages/gevent/greenlet.py", line 1067, in joinall
return wait(greenlets, timeout=timeout, count=count)
File "/elkeid/hub/py/pypy/site-packages/gevent/_hub_primitives.py", line 287, in wait_on_objects
return list(iwait_on_objects(objects, timeout, count))
File "/elkeid/hub/py/pypy/site-packages/gevent/_hub_primitives.py", line 176, in __next__
item = self._waiter.get()
File "/elkeid/hub/py/pypy/site-packages/gevent/_waiter.py", line 195, in get
Waiter.get(self)
File "/elkeid/hub/py/pypy/site-packages/gevent/_waiter.py", line 154, in get
return self.hub.switch()
File "/elkeid/hub/py/pypy/site-packages/gevent/_greenlet_primitives.py", line 65, in switch
return _greenlet_switch(self) # pylint:disable=undefined-variable
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib_pypy/greenlet.py", line 61, in switch
return self.__switch('switch', (args, kwds))
File "/elkeid/hub/py/pypy3.7-v7.3.5-linux64/lib_pypy/greenlet.py", line 115, in __switch
args, kwds = unbound_method(current, *baseargs, to=target)
File "/elkeid/hub/py/pypy/site-packages/gevent/libev/corecffi.py", line 61, in python_prepare_callback
AbstractCallbacks.python_prepare_callback(self, watcher_ptr)
File "/elkeid/hub/py/pypy/site-packages/gevent/_ffi/loop.py", line 302, in python_prepare_callback
loop._run_callbacks()
File "/elkeid/hub/py/pypy/site-packages/gevent/_ffi/loop.py", line 489, in _run_callbacks
while self._callbacks:
KeyboardInterrupt
generating ./_elkeid_queue.c
(already up-to-date)
the current directory is '/elkeid/hub/py'
running build_ext
building '_elkeid_queue' extension
gcc -pthread -DNDEBUG -O2 -fPIC -I. -I/elkeid/hub/py/pypy/include -I/elkeid/hub/py/pypy3.7-v7.3.5-linux64/include -c _elkeid_queue.c -o ./_elkeid_queue.o -std=c99
gcc -pthread -shared ./_elkeid_queue.o -lm -lrt -o ./_elkeid_queue.pypy37-pp73-x86_64-linux-gnu.so
INFO:root:use plugin dir: /elkeid/hub/config/plugin
INFO:root:zip_dir:/elkeid/hub/py/plugin_zip
INFO:root:unzip_dir:/elkeid/hub/py/plugin_unzip
INFO:root:load local plugin: /elkeid/hub/config/plugin/CompressAlert
INFO:root:load local plugin: /elkeid/hub/config/plugin/DNSptr
INFO:root:load local plugin: /elkeid/hub/config/plugin/SendToWeCom
INFO:root:load local plugin: /elkeid/hub/config/plugin/SendToDingding
INFO:root:load local plugin: /elkeid/hub/config/plugin/SendToLarkGroup
INFO:root:load local plugin: /elkeid/hub/config/plugin/SendToTelegram
INFO:root:load local plugin: /elkeid/hub/config/plugin/SendToLark
INFO:root:{"Modify:CompressAlert": {"key": "Modify:CompressAlert", "name": "CompressAlert", "type": "Modify", "err": ""}, "Append:DNSptr": {"key": "Append:DNSptr", "name": "DNSptr", "type": "Append", "err": ""}, "Action:SendToWeCom": {"key": "Action:SendToWeCom", "name": "SendToWeCom", "type": "Action", "err": ""}, "Action:SendToDingding": {"key": "Action:SendToDingding", "name": "SendToDingding", "type": "Action", "err": ""}, "Action:SendToLarkGroup": {"key": "Action:SendToLarkGroup", "name": "SendToLarkGroup", "type": "Action", "err": ""}, "Action:SendToTelegram": {"key": "Action:SendToTelegram", "name": "SendToTelegram", "type": "Action", "err": ""}, "Action:SendToLark": {"key": "Action:SendToLark", "name": "SendToLark", "type": "Action", "err": ""}}
INFO:root:{'Modify:CompressAlert': <bound method Plugin.plugin_exec of <CompressAlert.plugin.Plugin object at 0x0000000002a55b78>>, 'Append:DNSptr': <bound method Plugin.plugin_exec of <DNSptr.plugin.Plugin object at 0x0000000002f83e50>>, 'Action:SendToWeCom': <bound method Plugin.plugin_exec of <SendToWeCom.plugin.Plugin object at 0x000000000304a800>>, 'Action:SendToDingding': <bound method Plugin.plugin_exec of <SendToDingding.plugin.Plugin object at 0x000000000304a4f0>>, 'Action:SendToLarkGroup': <bound method Plugin.plugin_exec of <SendToLarkGroup.plugin.Plugin object at 0x000000000304a1a8>>, 'Action:SendToTelegram': <bound method Plugin.plugin_exec of <SendToTelegram.plugin.Plugin object at 0x000000000304aec8>>, 'Action:SendToLark': <bound method Plugin.plugin_exec of <SendToLark.plugin.Plugin object at 0x000000000304af00>>}
INFO:root:{"Modify:CompressAlert": {"key": "Modify:CompressAlert", "name": "CompressAlert", "type": "Modify", "err": ""}, "Append:DNSptr": {"key": "Append:DNSptr", "name": "DNSptr", "type": "Append", "err": ""}, "Action:SendToWeCom": {"key": "Action:SendToWeCom", "name": "SendToWeCom", "type": "Action", "err": ""}, "Action:SendToDingding": {"key": "Action:SendToDingding", "name": "SendToDingding", "type": "Action", "err": ""}, "Action:SendToLarkGroup": {"key": "Action:SendToLarkGroup", "name": "SendToLarkGroup", "type": "Action", "err": ""}, "Action:SendToTelegram": {"key": "Action:SendToTelegram", "name": "SendToTelegram", "type": "Action", "err": ""}, "Action:SendToLark": {"key": "Action:SendToLark", "name": "SendToLark", "type": "Action", "err": ""}}
INFO:root:{"Modify:CompressAlert": {"key": "Modify:CompressAlert", "name": "CompressAlert", "type": "Modify", "err": ""}, "Append:DNSptr": {"key": "Append:DNSptr", "name": "DNSptr", "type": "Append", "err": ""}, "Action:SendToWeCom": {"key": "Action:SendToWeCom", "name": "SendToWeCom", "type": "Action", "err": ""}, "Action:SendToDingding": {"key": "Action:SendToDingding", "name": "SendToDingding", "type": "Action", "err": ""}, "Action:SendToLarkGroup": {"key": "Action:SendToLarkGroup", "name": "SendToLarkGroup", "type": "Action", "err": ""}, "Action:SendToTelegram": {"key": "Action:SendToTelegram", "name": "SendToTelegram", "type": "Action", "err": ""}, "Action:SendToLark": {"key": "Action:SendToLark", "name": "SendToLark", "type": "Action", "err": ""}}
ruleset
<rule rule_id="rule_test_detect" author="Elkeid" type="Detection">
<rule_name>rule_test_detect</rule_name>
<alert_data>True</alert_data>
<harm_level>high</harm_level>
<desc kill_chain_id="evasion" affected_target="host_process">rule_test</desc>
<filter part="data_type">59</filter>
<check_list>
<check_node type="INCL" part="exe">/bin/id</check_node>
</check_list>
<node_designate></node_designate>
<del />
<action />
<modify>CompressAlert</modify>
<append type="static" append_field_name="alert_type_us">evasion</append>
<append type="static" append_field_name="compress_flag">nodename_argv</append>
<append type="static" append_field_name="rule_name">rule_test_detect</append>
</rule>
插件代码
from cacheout import LRUCache
class Plugin(object):
def __init__(self):
self.name = None
self.type = None
self.log = None
self.redis = None
self.cache = LRUCache(maxsize=1024 * 1024)
def plugin_exec(self, arg, config):
result = dict()
'''
"compress_flag": "nodename_argv"
'''
cache_key = "{}_{}".format(arg['SMITH_INPUT'], arg['SMITH_KEY'])
result["flag"] = False
result["msg"] = ""
if "compress_flag" in arg.keys():
key_list = arg.get('compress_flag').split("_")
cache_key = "_".join([arg[k] for k in key_list])
cache_result = self.cache.get(cache_key)
if cache_result is None:
self.cache.set(cache_key, arg, ttl=60)
result["flag"] = True
result["msg"] = arg
self.log.info(result)
return result
self.log.info(result)
return result