61 lines
No EOL
1.9 KiB
Python
61 lines
No EOL
1.9 KiB
Python
import asyncio
|
|
import threading
|
|
from datetime import datetime
|
|
from pysnmp.entity import engine, config
|
|
from pysnmp.carrier.asyncio.dgram import udp
|
|
from pysnmp.entity.rfc3413 import ntfrcv
|
|
from flask import Flask
|
|
from models import db, Event
|
|
from event_processor import process_event_for_enrichment
|
|
|
|
app = Flask(__name__)
|
|
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///siem.db'
|
|
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
|
|
db.init_app(app)
|
|
|
|
def trap_callback(snmpEngine, stateReference, contextEngineId, contextName,
|
|
varBinds, cbCtx):
|
|
source_ip = "unknown"
|
|
timestamp = datetime.utcnow()
|
|
|
|
with app.app_context():
|
|
event_ids_to_process = []
|
|
for name, val in varBinds:
|
|
event = Event(
|
|
timestamp=timestamp,
|
|
source_ip=source_ip,
|
|
event_type="snmp_trap",
|
|
protocol="udp",
|
|
oid=name.prettyPrint(),
|
|
value=val.prettyPrint(),
|
|
severity="Unknown"
|
|
)
|
|
db.session.add(event)
|
|
db.session.flush()
|
|
event_ids_to_process.append(event.id)
|
|
db.session.commit()
|
|
print(f'Received SNMP Trap (source IP: {source_ip})')
|
|
|
|
for event_id in event_ids_to_process:
|
|
process_event_for_enrichment(event_id)
|
|
|
|
async def run_snmp_listener(port=1162):
|
|
snmpEngine = engine.SnmpEngine()
|
|
|
|
config.addTransport(
|
|
snmpEngine,
|
|
udp.domainName,
|
|
udp.UdpAsyncioTransport().openServerMode(('0.0.0.0', port))
|
|
)
|
|
|
|
config.addV1System(snmpEngine, 'my-area', 'public')
|
|
ntfrcv.NotificationReceiver(snmpEngine, trap_callback)
|
|
|
|
print(f'SNMP Trap listener started on 0.0.0.0:{port}')
|
|
await asyncio.Event().wait()
|
|
|
|
def start_snmp_listener_in_thread(port=1162):
|
|
def runner():
|
|
asyncio.run(run_snmp_listener(port))
|
|
thread = threading.Thread(target=runner, daemon=True)
|
|
thread.start() |