search

eenblam / peekapp

peekapp is a rule-based IDS layer. Just an old class project.
0 stars 0 forks source link

Write alert summarizer that removes duplicate logs and includes counts of logs #6

Open eenblam opened 7 years ago

eenblam commented 7 years ago

Now:

ILLEGAL_WHATEVER 5 packets from SRC to DST between T1 and T2
    asdf
    asdf
    qwerty
    asdf
    qwerty

Desired:

ILLEGAL_WHATEVER 5 packets from SRC to DST between T1 and T2
    3 asdf
    2 qwerty

Shouldn't be much harder than

from collections import Counter

#...

c = sorted(Counter(logs).items(),
        key=lambda x: x[0])

f = lambda key, count: '\t' + str(count) + '\t + key

log_lines = '\n'.join(f(k,v) for k,v in c)