OSSIM-agent源代码分析（七）

2021SC@SDUSC

ParerWMI.py
OSSIM-agent源代码分析（七）

简述

OSSIM Agent的主要职责是收集网络上存在的各种设备发送的所有数据，然后按照一种标准方式（standardized way）有序的发送给OSSIM Server，Agent收集到数据后在发送给Server之前要对这些数据进行标准化处理，这样Server就可以依一种统一的方式来处理这些信息，并且也简化了Server的处理过程

python用WMI等获取windows系统信息以及修改系统的相关配置则也是非常重要的部分，直接和操作系统配置修改、日志有关系，相关代码分析如下

相关代码

初始导包

import os
import sys
import time
import re
import socket
import commands
from time import sleep
from Detector import Detector
from Event import Event
from Logger import Logger

类ParerWMI的创建，包含基础变量的声明和设置，主要是WMI EventLog解析器，改编自数据库解析器，同时为了确保它能与更多的wmi内容一起工作，而不仅仅是windows日志文件，需要使用不同的语言/ windows版本进行测试

class ParserWMI(Detector):
    LAST_RECORD_FILE_TMP = "/etc/ossim/agent/wmi_%s_%s"
    VALID_SECTIONS = ["Application", "Security","System"]
    CMD_CHECK_SECTION = "wmic -U %s%%%s //%s \"SELECT LogfileName FROM Win32_NTEventLogFile where LogfileName='%s'\""
    # To get las record by time: "Select TimeWritten from Win32_NTLogEvent Where Logfile = 'Application' and TimeWritten >\"20110803103502.000000-000\""
    CMD_GET_LAST_RECORD = "wmic -U %s%%%s //%s  \"Select LogFile,RecordNumber from Win32_NTLogEvent Where Logfile = '%s'\" | head -n 3 | tail -n 1 | cut -f 2 -d \|"
    CMD = "wmic -U %s%%%s //%s %s"
    def __init__(self, conf, plugin, conn, hostname, username, password):
        self.__conf = conf
        self.__plugin = plugin
        self.__rules = []          
        self.__conn = conn
        self.__hostname = hostname
        self.__username = username
        self.__password = password.strip()
        self.__section = self.__plugin.get("config", "section")
        self.__last_record_time = ""
        if self.__section == "":
            rules = self.__plugin.rules()
            cmd_str = rules['cmd']['cmd']
            for sec in ParserWMI.VALID_SECTIONS:
                if cmd_str.find(sec)>=0:
                    self.__section = sec
                    logger.warning("section doesn't found in [config].Section deduced: %s " % self.__section)
                    break
            if self.__section == "":
                self.__section = "Security"
                logger.warning("section doesn't found in [config].It can't be deduced: Setting it to default value: %s" % self.__section)
        self.__pluginID = self.__plugin.get("DEFAULT", "plugin_id")
        self.__stop_processing = False
        self.__sectionExists = False
        Detector.__init__(self, conf, plugin,