Botnet monitoring is a crucial part in threat analysis and often neglected due to the lack of proper open source tools. Our tool will provide an open source framework for automated botnet monitoring. The modular design will allow full customization of the used protocols, the monitoring clients behavior, how we log the collected information, processing of the data to analyze the botnets purpose, size and threat and how the monitoring task are distributed between dedicated nodes.
create id {} - creates monitor based on json encoded value XYZ (JSON supports proper validation)
load id file_name - loads the settings file file_name from the settings directory. Settings file should be JSON encoded (right now we are using ConfigObj but I guess JSON is good enough and can be based on the create value)
status - lists all settings and their monitor status
stop id - stops the monitor with id 'id'
restart id - restarts the monitor with id 'id'
delete id - deletes the setting with the coresbonding id
id is a unique string. I suggest to also create an additional integer id on setting creating.
Provide a cli (probably based on Cmd) to add new networks on the fly. Maybe extend to be used to manage the monitored networks.