2010-08-14 14:30:41 +02:00
\hypertarget { spp_ _ ai_ 8h} {
\section { spp\_ \- ai.h File Reference}
\label { spp_ _ ai_ 8h} \index { spp\_ \- ai.h@{ spp\_ \- ai.h} }
}
{ \ttfamily \# include \char `\" { } sf\_ \- snort\_ \- packet.h\char `\" { } } \par
2010-08-16 22:09:34 +02:00
{ \ttfamily \# include \char `\" { } sf\_ \- dynamic\_ \- preprocessor.h\char `\" { } } \par
{ \ttfamily \# include \char `\" { } uthash.h\char `\" { } } \par
2010-08-14 14:30:41 +02:00
\subsection * { Data Structures}
\begin { DoxyCompactItemize}
\item
2010-08-16 22:09:34 +02:00
struct \hyperlink { structpkt_ _ key} { pkt\_ \- key}
\item
struct \hyperlink { structpkt_ _ info} { pkt\_ \- info}
\item
struct \hyperlink { structAI_ _ config} { AI\_ \- config}
\item
struct \hyperlink { struct_ _ hierarchy_ _ node} { \_ \- hierarchy\_ \- node}
\item
2010-09-11 12:45:30 +02:00
struct \hyperlink { structAI_ _ hyperalert_ _ key} { AI\_ \- hyperalert\_ \- key}
\item
struct \hyperlink { structAI_ _ hyperalert_ _ info} { AI\_ \- hyperalert\_ \- info}
\item
2010-08-16 22:09:34 +02:00
struct \hyperlink { struct_ _ AI_ _ snort_ _ alert} { \_ \- AI\_ \- snort\_ \- alert}
\end { DoxyCompactItemize}
\subsection * { Defines}
\begin { DoxyCompactItemize}
\item
\# define \hyperlink { spp_ _ ai_ 8h_ a5e151c615eda34903514212f05a5ccf8} { PRIVATE} ~static
\item
\# define \hyperlink { spp_ _ ai_ 8h_ a5f555c0ebd29ce2771a3e2dd4f526746} { DEFAULT\_ \- HASH\_ \- CLEANUP\_ \- INTERVAL} ~300
\item
\# define \hyperlink { spp_ _ ai_ 8h_ a0f6a189af15ef783fb46ed37c144e031} { DEFAULT\_ \- STREAM\_ \- EXPIRE\_ \- INTERVAL} ~300
\item
2010-09-04 21:33:53 +02:00
\# define \hyperlink { spp_ _ ai_ 8h_ a3c4984a0ee515fbc091ac6e33b05e310} { DEFAULT\_ \- DATABASE\_ \- INTERVAL} ~30
\item
2010-08-16 22:09:34 +02:00
\# define \hyperlink { spp_ _ ai_ 8h_ a0c4b6fce670e46083e33b9f53b78f39e} { DEFAULT\_ \- ALERT\_ \- CLUSTERING\_ \- INTERVAL} ~3600
\item
2010-09-11 02:12:39 +02:00
\# define \hyperlink { spp_ _ ai_ 8h_ af0edda6cc018d9674b6822f6df4abe74} { DEFAULT\_ \- ALERT\_ \- CORRELATION\_ \- INTERVAL} ~300
\item
2010-08-16 22:09:34 +02:00
\# define \hyperlink { spp_ _ ai_ 8h_ a6d9bf552c32371e0144dc6a6209c7e4a} { DEFAULT\_ \- ALERT\_ \- LOG\_ \- FILE} ~\char `\" { } /var/log/snort/alert\char `\" { }
\item
\# define \hyperlink { spp_ _ ai_ 8h_ a803dc913297ccdace9e604dbfecda97d} { DEFAULT\_ \- CLUSTER\_ \- LOG\_ \- FILE} ~\char `\" { } /var/log/snort/cluster\_ \- alert\char `\" { }
2010-09-11 02:12:39 +02:00
\item
\# define \hyperlink { spp_ _ ai_ 8h_ a89448386cad5d5533992ae7ee84f4f1d} { DEFAULT\_ \- CORR\_ \- RULES\_ \- DIR} ~\char `\" { } /etc/snort/corr\_ \- rules\char `\" { }
2010-09-14 19:24:03 +02:00
\item
\# define \hyperlink { spp_ _ ai_ 8h_ a7bbeccba60012abcc98db33d39294829} { DEFAULT\_ \- CORR\_ \- ALERTS\_ \- DIR} ~\char `\" { } /var/log/snort/correlated\_ \- alerts\char `\" { }
\item
\# define \hyperlink { spp_ _ ai_ 8h_ aaedb0b7dc2bdf8d44d3fee2189a55a19} { DEFAULT\_ \- CORR\_ \- THRESHOLD} ~0.5
2010-08-14 14:30:41 +02:00
\end { DoxyCompactItemize}
\subsection * { Typedefs}
\begin { DoxyCompactItemize}
\item
2010-08-16 22:09:34 +02:00
typedef unsigned char \hyperlink { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5} { uint8\_ \- t}
2010-08-14 14:30:41 +02:00
\item
typedef unsigned short \hyperlink { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} { uint16\_ \- t}
\item
2010-08-16 22:09:34 +02:00
typedef unsigned int \hyperlink { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62} { uint32\_ \- t}
\item
typedef struct \hyperlink { struct_ _ hierarchy_ _ node} { \_ \- hierarchy\_ \- node} \hyperlink { spp_ _ ai_ 8h_ a466391129919ef12366d311d501552fa} { hierarchy\_ \- node}
\item
typedef struct \hyperlink { struct_ _ AI_ _ snort_ _ alert} { \_ \- AI\_ \- snort\_ \- alert} \hyperlink { spp_ _ ai_ 8h_ a982be90e72362e88d09f28336c9a1897} { AI\_ \- snort\_ \- alert}
2010-08-14 14:30:41 +02:00
\end { DoxyCompactItemize}
\subsection * { Enumerations}
\begin { DoxyCompactItemize}
\item
enum \hyperlink { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18dd} { BOOL} \{ \hyperlink { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18ddae9de385ef6fe9bf3360d1038396b884c} { false} ,
\hyperlink { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18dda08f175a5505a10b9ed657defeb050e4b} { true}
\}
2010-08-16 22:09:34 +02:00
\item
enum \hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640} { cluster\_ \- type} \{ \par
\hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ab7e4e0120a041dbe6528b050c04269e0} { none} ,
\hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640abc900639df18f0f5f2f63a1f033fe42f} { src\_ \- addr} ,
\hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640aa000f955ef1374c60cdb16bf43a1593c} { dst\_ \- addr} ,
\hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ac1335c508143eb06843af2ce5ff3027b} { src\_ \- port} ,
\par
\hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640abc4f89a184ada44073bd6f54d7fc11c9} { dst\_ \- port} ,
\hyperlink { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ab16bb5c4b330d5db02e2d852cd2ba451} { CLUSTER\_ \- TYPES}
\}
2010-08-14 14:30:41 +02:00
\end { DoxyCompactItemize}
\subsection * { Functions}
\begin { DoxyCompactItemize}
\item
2010-09-04 21:33:53 +02:00
int \hyperlink { group_ _ regex_ ga35f57c052a7de1ded54b67a1f7819791} { preg\_ \- match} (const char $ \ast $ , char $ \ast $ , char $ \ast $ $ \ast $ $ \ast $ , int $ \ast $ )
2010-08-16 22:09:34 +02:00
\begin { DoxyCompactList} \small \item \em Check if a string matches a regular expression. \item \end { DoxyCompactList} \item
2010-09-11 12:45:30 +02:00
char $ \ast $ \hyperlink { group_ _ regex_ ga736ba1abdc4938cbb1bf5861e7dbfd50} { str\_ \- replace} (char $ \ast $ str, char $ \ast $ orig, char $ \ast $ rep)
\begin { DoxyCompactList} \small \item \em Replace the content of 'orig' in 'str' with 'rep'. \item \end { DoxyCompactList} \item
char $ \ast $ \hyperlink { group_ _ regex_ gaff6c55cd04fc08dd582e244590dc25a4} { str\_ \- replace\_ \- all} (char $ \ast $ str, char $ \ast $ orig, char $ \ast $ rep)
\begin { DoxyCompactList} \small \item \em Replace all of the occurrences of 'orig' in 'str' with 'rep'. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
void $ \ast $ \hyperlink { group_ _ stream_ ga24b1131374e5059564b8a12380c4eb75} { AI\_ \- hashcleanup\_ \- thread} (void $ \ast $ )
2010-08-16 22:09:34 +02:00
\begin { DoxyCompactList} \small \item \em Thread called for cleaning up the hash table from the traffic streams older than a certain threshold. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
void $ \ast $ \hyperlink { group_ _ alert_ _ parser_ ga5aab8d9bdf0e92a51731442fd787f61f} { AI\_ \- file\_ \- alertparser\_ \- thread} (void $ \ast $ )
2010-08-16 22:09:34 +02:00
\begin { DoxyCompactList} \small \item \em Thread for parsing Snort's alert file. \item \end { DoxyCompactList} \item
2010-09-11 02:12:39 +02:00
void $ \ast $ \hyperlink { group_ _ correlation_ ga939353a4e15de7a8f4145ab986f584be} { AI\_ \- alert\_ \- correlation\_ \- thread} (void $ \ast $ )
\begin { DoxyCompactList} \small \item \em Thread for correlating clustered alerts. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
void \hyperlink { group_ _ stream_ ga7d71c5645b9baff7b6c4b9a181bf80c5} { AI\_ \- pkt\_ \- enqueue} (SFSnortPacket $ \ast $ )
2010-08-14 14:30:41 +02:00
\begin { DoxyCompactList} \small \item \em Function called for appending a new packet to the hash table, creating a new stream or appending it to an existing stream. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
void \hyperlink { group_ _ stream_ ga8749989cee2ac05a7de058faac280c02} { AI\_ \- set\_ \- stream\_ \- observed} (struct \hyperlink { structpkt_ _ key} { pkt\_ \- key} key)
2010-08-16 22:09:34 +02:00
\begin { DoxyCompactList} \small \item \em Set the flag \char `\" { } observed\char `\" { } on a stream associated to a security alert, so that it won't be removed from the hash table. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
void \hyperlink { group_ _ cluster_ ga1445818b37483f78cc3fb2890155842c} { AI\_ \- hierarchies\_ \- build} (\hyperlink { structAI_ _ config} { AI\_ \- config} $ \ast $ , \hyperlink { struct_ _ hierarchy_ _ node} { hierarchy\_ \- node} $ \ast $ $ \ast $ , int)
2010-08-16 22:09:34 +02:00
\begin { DoxyCompactList} \small \item \em Build the clustering hierarchy trees. \item \end { DoxyCompactList} \item
2010-09-11 02:12:39 +02:00
void \hyperlink { group_ _ alert_ _ parser_ ga270e86669a0aa64a8da37bc16cda645b} { AI\_ \- free\_ \- alerts} (\hyperlink { struct_ _ AI_ _ snort_ _ alert} { AI\_ \- snort\_ \- alert} $ \ast $ node)
\begin { DoxyCompactList} \small \item \em Deallocate the memory of a log alert linked list. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
struct \hyperlink { structpkt_ _ info} { pkt\_ \- info} $ \ast $ \hyperlink { group_ _ stream_ ga2efedcabbfd12c5345f0c93a3dd4735c} { AI\_ \- get\_ \- stream\_ \- by\_ \- key} (struct \hyperlink { structpkt_ _ key} { pkt\_ \- key} )
2010-08-16 22:09:34 +02:00
\begin { DoxyCompactList} \small \item \em Get a TCP stream by key. \item \end { DoxyCompactList} \item
2010-09-04 21:33:53 +02:00
\hyperlink { struct_ _ AI_ _ snort_ _ alert} { AI\_ \- snort\_ \- alert} $ \ast $ \hyperlink { group_ _ alert_ _ parser_ ga99474495643197b3075ac22ec6f6c70f} { AI\_ \- get\_ \- alerts} (void)
\begin { DoxyCompactList} \small \item \em Return the alerts parsed so far as a linked list. \item \end { DoxyCompactList} \item
2010-09-11 02:12:39 +02:00
\hyperlink { struct_ _ AI_ _ snort_ _ alert} { AI\_ \- snort\_ \- alert} $ \ast $ \hyperlink { group_ _ cluster_ ga2553c678eeb83282c230d649a0e8fcd4} { AI\_ \- get\_ \- clustered\_ \- alerts} (void)
\begin { DoxyCompactList} \small \item \em Return the alerts parsed so far as a linked list. \item \end { DoxyCompactList} \end { DoxyCompactItemize}
2010-08-16 22:09:34 +02:00
\subsection * { Variables}
\begin { DoxyCompactItemize}
\item
DynamicPreprocessorData \hyperlink { spp_ _ ai_ 8h_ ab46420126c43c1aac5eabc5db266a71c} { \_ \- dpd}
2010-09-04 21:33:53 +02:00
\item
\hyperlink { struct_ _ AI_ _ snort_ _ alert} { AI\_ \- snort\_ \- alert} $ \ast $ ($ \ast $ \hyperlink { spp_ _ ai_ 8h_ ab184b676360ce03035801284a2bd1ea7} { get\_ \- alerts} )(void)
2010-08-16 22:09:34 +02:00
\end { DoxyCompactItemize}
\subsection { Define Documentation}
\hypertarget { spp_ _ ai_ 8h_ a0c4b6fce670e46083e33b9f53b78f39e} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- ALERT\_ \- CLUSTERING\_ \- INTERVAL@{ DEFAULT\_ \- ALERT\_ \- CLUSTERING\_ \- INTERVAL} }
\index { DEFAULT\_ \- ALERT\_ \- CLUSTERING\_ \- INTERVAL@{ DEFAULT\_ \- ALERT\_ \- CLUSTERING\_ \- INTERVAL} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-ALERT\_\-CLUSTERING\_\-INTERVAL}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- ALERT\_ \- CLUSTERING\_ \- INTERVAL~3600} }
\label { spp_ _ ai_ 8h_ a0c4b6fce670e46083e33b9f53b78f39e}
2010-09-11 02:12:39 +02:00
Default interval in seconds for the thread clustering alerts \hypertarget { spp_ _ ai_ 8h_ af0edda6cc018d9674b6822f6df4abe74} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- ALERT\_ \- CORRELATION\_ \- INTERVAL@{ DEFAULT\_ \- ALERT\_ \- CORRELATION\_ \- INTERVAL} }
\index { DEFAULT\_ \- ALERT\_ \- CORRELATION\_ \- INTERVAL@{ DEFAULT\_ \- ALERT\_ \- CORRELATION\_ \- INTERVAL} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-ALERT\_\-CORRELATION\_\-INTERVAL}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- ALERT\_ \- CORRELATION\_ \- INTERVAL~300} }
\label { spp_ _ ai_ 8h_ af0edda6cc018d9674b6822f6df4abe74}
Default interval in seconds for running the graph correlation thread \hypertarget { spp_ _ ai_ 8h_ a6d9bf552c32371e0144dc6a6209c7e4a} {
2010-08-16 22:09:34 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- ALERT\_ \- LOG\_ \- FILE@{ DEFAULT\_ \- ALERT\_ \- LOG\_ \- FILE} }
\index { DEFAULT\_ \- ALERT\_ \- LOG\_ \- FILE@{ DEFAULT\_ \- ALERT\_ \- LOG\_ \- FILE} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-ALERT\_\-LOG\_\-FILE}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- ALERT\_ \- LOG\_ \- FILE~\char `\" { } /var/log/snort/alert\char `\" { } } }
\label { spp_ _ ai_ 8h_ a6d9bf552c32371e0144dc6a6209c7e4a}
2010-09-04 21:33:53 +02:00
Default path to Snort's log file \hypertarget { spp_ _ ai_ 8h_ a803dc913297ccdace9e604dbfecda97d} {
2010-08-16 22:09:34 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- CLUSTER\_ \- LOG\_ \- FILE@{ DEFAULT\_ \- CLUSTER\_ \- LOG\_ \- FILE} }
\index { DEFAULT\_ \- CLUSTER\_ \- LOG\_ \- FILE@{ DEFAULT\_ \- CLUSTER\_ \- LOG\_ \- FILE} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-CLUSTER\_\-LOG\_\-FILE}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- CLUSTER\_ \- LOG\_ \- FILE~\char `\" { } /var/log/snort/cluster\_ \- alert\char `\" { } } }
\label { spp_ _ ai_ 8h_ a803dc913297ccdace9e604dbfecda97d}
2010-09-14 19:24:03 +02:00
Default path to Snort's clustered alerts file \hypertarget { spp_ _ ai_ 8h_ a7bbeccba60012abcc98db33d39294829} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- CORR\_ \- ALERTS\_ \- DIR@{ DEFAULT\_ \- CORR\_ \- ALERTS\_ \- DIR} }
\index { DEFAULT\_ \- CORR\_ \- ALERTS\_ \- DIR@{ DEFAULT\_ \- CORR\_ \- ALERTS\_ \- DIR} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-CORR\_\-ALERTS\_\-DIR}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- CORR\_ \- ALERTS\_ \- DIR~\char `\" { } /var/log/snort/correlated\_ \- alerts\char `\" { } } }
\label { spp_ _ ai_ 8h_ a7bbeccba60012abcc98db33d39294829}
Default directory for placing correlated alerts information (.dot and possibly .png files) \hypertarget { spp_ _ ai_ 8h_ a89448386cad5d5533992ae7ee84f4f1d} {
2010-09-11 02:12:39 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- CORR\_ \- RULES\_ \- DIR@{ DEFAULT\_ \- CORR\_ \- RULES\_ \- DIR} }
\index { DEFAULT\_ \- CORR\_ \- RULES\_ \- DIR@{ DEFAULT\_ \- CORR\_ \- RULES\_ \- DIR} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-CORR\_\-RULES\_\-DIR}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- CORR\_ \- RULES\_ \- DIR~\char `\" { } /etc/snort/corr\_ \- rules\char `\" { } } }
\label { spp_ _ ai_ 8h_ a89448386cad5d5533992ae7ee84f4f1d}
2010-09-14 19:24:03 +02:00
Default path to alert correlation rules directory \hypertarget { spp_ _ ai_ 8h_ aaedb0b7dc2bdf8d44d3fee2189a55a19} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- CORR\_ \- THRESHOLD@{ DEFAULT\_ \- CORR\_ \- THRESHOLD} }
\index { DEFAULT\_ \- CORR\_ \- THRESHOLD@{ DEFAULT\_ \- CORR\_ \- THRESHOLD} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-CORR\_\-THRESHOLD}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- CORR\_ \- THRESHOLD~0.5} }
\label { spp_ _ ai_ 8h_ aaedb0b7dc2bdf8d44d3fee2189a55a19}
Default correlation threshold coefficient for correlating two hyperalerts \hypertarget { spp_ _ ai_ 8h_ a3c4984a0ee515fbc091ac6e33b05e310} {
2010-09-04 21:33:53 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- DATABASE\_ \- INTERVAL@{ DEFAULT\_ \- DATABASE\_ \- INTERVAL} }
\index { DEFAULT\_ \- DATABASE\_ \- INTERVAL@{ DEFAULT\_ \- DATABASE\_ \- INTERVAL} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-DATABASE\_\-INTERVAL}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- DATABASE\_ \- INTERVAL~30} }
\label { spp_ _ ai_ 8h_ a3c4984a0ee515fbc091ac6e33b05e310}
Default interval in seconds for reading alerts from the alert database, if used \hypertarget { spp_ _ ai_ 8h_ a5f555c0ebd29ce2771a3e2dd4f526746} {
2010-08-16 22:09:34 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- HASH\_ \- CLEANUP\_ \- INTERVAL@{ DEFAULT\_ \- HASH\_ \- CLEANUP\_ \- INTERVAL} }
\index { DEFAULT\_ \- HASH\_ \- CLEANUP\_ \- INTERVAL@{ DEFAULT\_ \- HASH\_ \- CLEANUP\_ \- INTERVAL} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-HASH\_\-CLEANUP\_\-INTERVAL}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- HASH\_ \- CLEANUP\_ \- INTERVAL~300} }
\label { spp_ _ ai_ 8h_ a5f555c0ebd29ce2771a3e2dd4f526746}
2010-09-04 21:33:53 +02:00
Default interval in seconds for the thread cleaning up TCP streams \hypertarget { spp_ _ ai_ 8h_ a0f6a189af15ef783fb46ed37c144e031} {
2010-08-16 22:09:34 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !DEFAULT\_ \- STREAM\_ \- EXPIRE\_ \- INTERVAL@{ DEFAULT\_ \- STREAM\_ \- EXPIRE\_ \- INTERVAL} }
\index { DEFAULT\_ \- STREAM\_ \- EXPIRE\_ \- INTERVAL@{ DEFAULT\_ \- STREAM\_ \- EXPIRE\_ \- INTERVAL} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{DEFAULT\_\-STREAM\_\-EXPIRE\_\-INTERVAL}] { \setlength { \rightskip } { 0pt plus 5cm} \# define DEFAULT\_ \- STREAM\_ \- EXPIRE\_ \- INTERVAL~300} }
\label { spp_ _ ai_ 8h_ a0f6a189af15ef783fb46ed37c144e031}
2010-09-04 21:33:53 +02:00
Default interval in seconds before a stream without any packet is considered timed out \hypertarget { spp_ _ ai_ 8h_ a5e151c615eda34903514212f05a5ccf8} {
2010-08-16 22:09:34 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !PRIVATE@{ PRIVATE} }
\index { PRIVATE@{ PRIVATE} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{PRIVATE}] { \setlength { \rightskip } { 0pt plus 5cm} \# define PRIVATE~static} }
\label { spp_ _ ai_ 8h_ a5e151c615eda34903514212f05a5ccf8}
2010-08-14 14:30:41 +02:00
\subsection { Typedef Documentation}
2010-08-16 22:09:34 +02:00
\hypertarget { spp_ _ ai_ 8h_ a982be90e72362e88d09f28336c9a1897} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !AI\_ \- snort\_ \- alert@{ AI\_ \- snort\_ \- alert} }
\index { AI\_ \- snort\_ \- alert@{ AI\_ \- snort\_ \- alert} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{AI\_\-snort\_\-alert}] { \setlength { \rightskip } { 0pt plus 5cm} typedef struct { \bf \_ \- AI\_ \- snort\_ \- alert} { \bf AI\_ \- snort\_ \- alert} } }
\label { spp_ _ ai_ 8h_ a982be90e72362e88d09f28336c9a1897}
2010-09-04 21:33:53 +02:00
Data type for Snort alerts \hypertarget { spp_ _ ai_ 8h_ a466391129919ef12366d311d501552fa} {
2010-08-16 22:09:34 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !hierarchy\_ \- node@{ hierarchy\_ \- node} }
\index { hierarchy\_ \- node@{ hierarchy\_ \- node} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{hierarchy\_\-node}] { \setlength { \rightskip } { 0pt plus 5cm} typedef struct { \bf \_ \- hierarchy\_ \- node} { \bf hierarchy\_ \- node} } }
\label { spp_ _ ai_ 8h_ a466391129919ef12366d311d501552fa}
2010-09-11 12:45:30 +02:00
Data type for hierarchies used for clustering \hypertarget { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30} {
2010-08-14 14:30:41 +02:00
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !uint16\_ \- t@{ uint16\_ \- t} }
\index { uint16\_ \- t@{ uint16\_ \- t} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{uint16\_\-t}] { \setlength { \rightskip } { 0pt plus 5cm} typedef unsigned short { \bf uint16\_ \- t} } }
\label { spp_ _ ai_ 8h_ a273cf69d639a59973b6019625df33e30}
\hypertarget { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !uint32\_ \- t@{ uint32\_ \- t} }
\index { uint32\_ \- t@{ uint32\_ \- t} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{uint32\_\-t}] { \setlength { \rightskip } { 0pt plus 5cm} typedef unsigned int { \bf uint32\_ \- t} } }
\label { spp_ _ ai_ 8h_ a435d1572bf3f880d55459d9805097f62}
2010-08-16 22:09:34 +02:00
\hypertarget { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !uint8\_ \- t@{ uint8\_ \- t} }
\index { uint8\_ \- t@{ uint8\_ \- t} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{uint8\_\-t}] { \setlength { \rightskip } { 0pt plus 5cm} typedef unsigned char { \bf uint8\_ \- t} } }
\label { spp_ _ ai_ 8h_ aba7bc1797add20fe3efdf37ced1182c5}
2010-08-14 14:30:41 +02:00
\subsection { Enumeration Type Documentation}
\hypertarget { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18dd} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !BOOL@{ BOOL} }
\index { BOOL@{ BOOL} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{BOOL}] { \setlength { \rightskip } { 0pt plus 5cm} enum { \bf BOOL} } }
\label { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18dd}
\begin { Desc}
\item [Enumerator: ] \par
\begin { description}
\index { false@{ false} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !false@{ false} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18ddae9de385ef6fe9bf3360d1038396b884c} {
false}
\label { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18ddae9de385ef6fe9bf3360d1038396b884c}
} ]\index { true@{ true} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !true@{ true} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18dda08f175a5505a10b9ed657defeb050e4b} {
true}
\label { spp_ _ ai_ 8h_ a3e5b8192e7d9ffaf3542f1210aec18dda08f175a5505a10b9ed657defeb050e4b}
} ]\end { description}
\end { Desc}
2010-08-16 22:09:34 +02:00
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !cluster\_ \- type@{ cluster\_ \- type} }
\index { cluster\_ \- type@{ cluster\_ \- type} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{cluster\_\-type}] { \setlength { \rightskip } { 0pt plus 5cm} enum { \bf cluster\_ \- type} } }
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640}
2010-09-04 21:33:53 +02:00
Possible types of clustering attributes \begin { Desc}
2010-08-16 22:09:34 +02:00
\item [Enumerator: ] \par
\begin { description}
\index { none@{ none} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !none@{ none} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ab7e4e0120a041dbe6528b050c04269e0} {
none}
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ab7e4e0120a041dbe6528b050c04269e0}
} ]\index { src\_ \- addr@{ src\_ \- addr} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !src\_ \- addr@{ src\_ \- addr} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640abc900639df18f0f5f2f63a1f033fe42f} {
src\_ \- addr}
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640abc900639df18f0f5f2f63a1f033fe42f}
} ]\index { dst\_ \- addr@{ dst\_ \- addr} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !dst\_ \- addr@{ dst\_ \- addr} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640aa000f955ef1374c60cdb16bf43a1593c} {
dst\_ \- addr}
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640aa000f955ef1374c60cdb16bf43a1593c}
} ]\index { src\_ \- port@{ src\_ \- port} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !src\_ \- port@{ src\_ \- port} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ac1335c508143eb06843af2ce5ff3027b} {
src\_ \- port}
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ac1335c508143eb06843af2ce5ff3027b}
} ]\index { dst\_ \- port@{ dst\_ \- port} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !dst\_ \- port@{ dst\_ \- port} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640abc4f89a184ada44073bd6f54d7fc11c9} {
dst\_ \- port}
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640abc4f89a184ada44073bd6f54d7fc11c9}
} ]\index { CLUSTER\_ \- TYPES@{ CLUSTER\_ \- TYPES} !spp\_ \- ai.h@{ spp\_ \- ai.h} } \index { spp\_ \- ai.h@{ spp\_ \- ai.h} !CLUSTER\_ \- TYPES@{ CLUSTER\_ \- TYPES} } \item [{ \em
\hypertarget { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ab16bb5c4b330d5db02e2d852cd2ba451} {
CLUSTER\_ \- TYPES}
\label { spp_ _ ai_ 8h_ ae2ff3c6586aa2ab211a102abfde86640ab16bb5c4b330d5db02e2d852cd2ba451}
} ]\end { description}
\end { Desc}
2010-08-14 14:30:41 +02:00
2010-08-16 22:09:34 +02:00
\subsection { Variable Documentation}
\hypertarget { spp_ _ ai_ 8h_ ab46420126c43c1aac5eabc5db266a71c} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !\_ \- dpd@{ \_ \- dpd} }
\index { \_ \- dpd@{ \_ \- dpd} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{\_\-dpd}] { \setlength { \rightskip } { 0pt plus 5cm} DynamicPreprocessorData { \bf \_ \- dpd} } }
\label { spp_ _ ai_ 8h_ ab46420126c43c1aac5eabc5db266a71c}
2010-09-04 21:33:53 +02:00
\hypertarget { spp_ _ ai_ 8h_ ab184b676360ce03035801284a2bd1ea7} {
\index { spp\_ \- ai.h@{ spp\_ \- ai.h} !get\_ \- alerts@{ get\_ \- alerts} }
\index { get\_ \- alerts@{ get\_ \- alerts} !spp_ ai.h@{ spp\_ \- ai.h} }
\subsubsection [{get\_\-alerts}] { \setlength { \rightskip } { 0pt plus 5cm} { \bf AI\_ \- snort\_ \- alert} $ \ast $ ($ \ast $ { \bf get\_ \- alerts} )(void)} }
\label { spp_ _ ai_ 8h_ ab184b676360ce03035801284a2bd1ea7}
Function pointer to the function used for getting the alert list (from log file, db, ...)
