|
| 1 | +#!/usr/bin/env python |
| 2 | + |
| 3 | +import csv |
| 4 | +import sys |
| 5 | +import socket |
| 6 | + |
| 7 | +""" An adapter that takes CSV as input, performs a lookup to the operating |
| 8 | + system hostname resolution facilities, then returns the CSV results |
| 9 | +
|
| 10 | + This is intended as an example of creating external lookups in general. |
| 11 | +
|
| 12 | + Note that the script offers mapping both ways, from host to IP and from IP |
| 13 | + to host. |
| 14 | + |
| 15 | + Bidrectional mapping is always required when using an external lookup as an |
| 16 | + 'automatic' lookup: one configured to be used without explicit reference in |
| 17 | + a search. |
| 18 | +
|
| 19 | + In the other use mode, eg in a search string as "|lookup lookupname", it is |
| 20 | + sufficient to provide only the mappings that will be used. |
| 21 | +
|
| 22 | + WARNING: DNS is not unambiguously reversible, so this script will produce |
| 23 | + unusual results when used for values that do not reverse-resolve to |
| 24 | + their original values in your environment. |
| 25 | +
|
| 26 | + For example, if your events have host=foo, and you search for |
| 27 | + ip=1.2.3.4, the generated search expression may be |
| 28 | + host=foo.yourcompany.com, which will not match. |
| 29 | +""" |
| 30 | + |
| 31 | + |
| 32 | +# Given a host, find the ip |
| 33 | +def lookup(host): |
| 34 | + try: |
| 35 | + hostname, aliaslist, ipaddrlist = socket.gethostbyname_ex(host) |
| 36 | + return ipaddrlist |
| 37 | + except: |
| 38 | + return [] |
| 39 | + |
| 40 | +# Given an ip, return the host |
| 41 | +def rlookup(ip): |
| 42 | + try: |
| 43 | + hostname, aliaslist, ipaddrlist = socket.gethostbyaddr(ip) |
| 44 | + return hostname |
| 45 | + except: |
| 46 | + return '' |
| 47 | + |
| 48 | +def main(): |
| 49 | + if len(sys.argv) != 3: |
| 50 | + print "Usage: python external_lookup.py [host field] [ip field]" |
| 51 | + sys.exit(1) |
| 52 | + |
| 53 | + hostfield = sys.argv[1] |
| 54 | + ipfield = sys.argv[2] |
| 55 | + |
| 56 | + infile = sys.stdin |
| 57 | + outfile = sys.stdout |
| 58 | + |
| 59 | + r = csv.DictReader(infile) |
| 60 | + header = r.fieldnames |
| 61 | + |
| 62 | + w = csv.DictWriter(outfile, fieldnames=r.fieldnames) |
| 63 | + w.writeheader() |
| 64 | + |
| 65 | + for result in r: |
| 66 | + # Perform the lookup or reverse lookup if necessary |
| 67 | + if result[hostfield] and result[ipfield]: |
| 68 | + # both fields were provided, just pass it along |
| 69 | + w.writerow(result) |
| 70 | + |
| 71 | + elif result[hostfield]: |
| 72 | + # only host was provided, add ip |
| 73 | + ips = lookup(result[hostfield]) |
| 74 | + for ip in ips: |
| 75 | + result[ipfield] = ip |
| 76 | + w.writerow(result) |
| 77 | + |
| 78 | + elif result[ipfield]: |
| 79 | + # only ip was provided, add host |
| 80 | + result[hostfield] = rlookup(result[ipfield]) |
| 81 | + if result[hostfield]: |
| 82 | + w.writerow(result) |
| 83 | + |
| 84 | +main() |
0 commit comments