--
-- Cybermon configuration file, used to tailor the behaviour of cybermon.
--
-- This configuration file uses data from a STIX server stored locally in
-- JSON format.  Triggers when STIX Indicators are detected to hit.
--

-- STIX support.
local stix = require("util.stix")
local addr = require("util.addresses")
local md5 = require("md5")

-- This file is a module, so you need to create a table, which will be
-- returned to the calling environment.  It doesn't matter what you call it.
local observer = {}

-- This function is called when a trigger events starts collection of an
-- attacker. liid=the trigger ID, addr=trigger address
observer.trigger_up = function(e)
end

-- This function is called when an attacker goes off the air
observer.trigger_down = function(e)
end

-- This function is called when a stream-orientated connection is made
-- (e.g. TCP)
observer.connection_up = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Connection with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when a stream-orientated connection is closed
observer.connection_down = function(e)
end

-- This function is called when a datagram is observed, but the protocol
-- is not recognised.
observer.unrecognised_datagram = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when stream data  is observed, but the protocol
-- is not recognised.
observer.unrecognised_stream = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an ICMP message is observed.
observer.icmp = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("ICMP with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an IMAP message is observed.
observer.imap = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an IMAP SSL message is observed.
observer.imap_ssl = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when a POP3 message is observed.
observer.pop3 = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when a POP3 SSL message is observed.
observer.pop3_ssl = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an HTTP request is observed.
observer.http_request = function(e)

  -- Hacky.  Construct the URL from bits of stuff we know.
  -- FIXME: URL may already by correct.
  url = "http://" .. header['Host'] .. url

  indicators = {}
  stix.check_url(e.url, indicators)
  stix.check_hash(md5.sumhexa(e.body), indicators)
  stix.check_dns(e.header['Host'], indicators)

  for k, v in pairs(indicators) do
    print(string.format("HTTP request to %s, hits %s (%s)", v.value,
        v.id, v.description))
  end

end

-- This function is called when an HTTP response is observed.
observer.http_response = function(e)

  indicators = {}
  stix.check_url(e.url, indicators)
  stix.check_hash(md5.sumhexa(e.body), indicators)

  for k, v in pairs(indicators) do
    print(string.format("HTTP response from %s, hits %s (%s)", v.value,
        v.id, v.description))
  end

end

-- This function is called when a SIP request message is observed.
observer.sip_request = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when a SIP response message is observed.
observer.sip_response = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when a SIP SSL message is observed.
observer.sip_ssl = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an SMTP command is observed.
observer.smtp_command = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("SMTP command with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an SMTP response is observed.
observer.smtp_response = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("SMTP response with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an SMTP response is observed.
observer.smtp_data = function(e)

  indicators = {}
  stix.check_email(e.from, indicators)

  for k, v in pairs(indicators) do
    print(string.format("SMTP email from %s, hits %s (%s)", v.value,
        v.id, v.description))
  end

  indicators = {}
  for k, v in pairs(e.to) do
    stix.check_email(v, indicators)
  end

  for k, v in pairs(indicators) do
    print(string.format("SMTP email to %s, hits %s (%s)", v.value,
        v.id, v.description))
  end

end

-- This function is called when a DNS message is observed.
observer.dns_message = function(e)

  if e.header.qr == 0 and #e.queries == 1 then
    indicators = {}
    stix.check_dns(e.queries[1].name, indicators)
    for k, v in pairs(indicators) do
      print(string.format("DNS query for %s, hits %s (%s)", e.queries[1].name,
          v.id, v.description))
    end
  end

  if e.header.qr == 1 and #e.queries == 1 then
    indicators = {}
    stix.check_dns(e.queries[1].name, indicators)
    for k, v in pairs(indicators) do
      print(string.format("DNS response for %s, hits %s (%s)", e.queries[1].name,
          v.id, v.description))
    end
  end

end

-- This function is called when an FTP command is observed.
observer.ftp_command = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("FTP response with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an FTP response is observed.
observer.ftp_response = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("FTP response with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an NTP timestamp message is observed.
observer.ntp_timestamp_message = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an NTP control message is observed.
observer.ntp_control_message = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end

-- This function is called when an NTP private message is observed.
observer.ntp_private_message = function(e)

  indicators = {}
  stix.check_addresses(e.context, indicators)

  for k, v in pairs(indicators) do
    print(string.format("Datagram with address %s, hits %s (%s)", v.value,
      v.id, v.description))
  end

end


-- Return the table
return observer

