[jira] [Commented] (METRON-1184) EC2 Deployment - Updating control_path to accommodate for Linux

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458949#comment-16458949
 ] 

ASF GitHub Bot commented on METRON-1184:


Github user lvets commented on the issue:

https://github.com/apache/metron/pull/754
  
This works for me on an Ubuntu 16.04 host.


> EC2 Deployment - Updating control_path to accommodate for Linux
> ---
>
> Key: METRON-1184
> URL: https://issues.apache.org/jira/browse/METRON-1184
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.1
> Environment: ClearOS[Distro of CentOS] npm 3.10.10, node 6.11.1, 
> docker 1.12.6, mvn 3.3.9, ansible 2.2.2.0, No Vagrant)
>Reporter: ashah
>Assignee: ashah
>Priority: Minor
>  Labels: amazon, cloud
> Fix For: Next + 1, 0.4.1
>
>
> PR: https://github.com/apache/metron/pull/754
> For 0.4.1-rc4, using "control_path = ~/.ssh/ansible-ssh-%%C" for a Linux 
> environment ( such as ClearOS[Distro of CentOS] npm 3.10.10, node 6.11.1, 
> docker 1.12.6, mvn 3.3.9, ansible 2.2.2.0, No Vagrant) could throw the 
> following error:
> ```
> "TASK [setup] 
> ***
> fatal: [ec2-xx-yy-0-130.us-west-2.compute.amazonaws.com]: UNREACHABLE! => 
> {"changed": false, "msg": "Failed to connect to the host via ssh: 
> percent_expand: unknown key %C\r\n", "unreachable": true}" 
> ```
> This PR is to change the line to "control_path = ~/.ssh/ansbile-ssh-%%h-%%r" 
> to make amazon-ec2 also potentially deployable with Linux while preserving a 
> small path length. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #754: METRON-1184 EC2 Deployment - Updating control_path to acc...

2018-04-30 Thread lvets
Github user lvets commented on the issue:

https://github.com/apache/metron/pull/754
  
This works for me on an Ubuntu 16.04 host.


---


[jira] [Commented] (METRON-1184) EC2 Deployment - Updating control_path to accommodate for Linux

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458704#comment-16458704
 ] 

ASF GitHub Bot commented on METRON-1184:


Github user lvets commented on the issue:

https://github.com/apache/metron/pull/754
  
Sorry about this, testing it now.


> EC2 Deployment - Updating control_path to accommodate for Linux
> ---
>
> Key: METRON-1184
> URL: https://issues.apache.org/jira/browse/METRON-1184
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.1
> Environment: ClearOS[Distro of CentOS] npm 3.10.10, node 6.11.1, 
> docker 1.12.6, mvn 3.3.9, ansible 2.2.2.0, No Vagrant)
>Reporter: ashah
>Assignee: ashah
>Priority: Minor
>  Labels: amazon, cloud
> Fix For: Next + 1, 0.4.1
>
>
> PR: https://github.com/apache/metron/pull/754
> For 0.4.1-rc4, using "control_path = ~/.ssh/ansible-ssh-%%C" for a Linux 
> environment ( such as ClearOS[Distro of CentOS] npm 3.10.10, node 6.11.1, 
> docker 1.12.6, mvn 3.3.9, ansible 2.2.2.0, No Vagrant) could throw the 
> following error:
> ```
> "TASK [setup] 
> ***
> fatal: [ec2-xx-yy-0-130.us-west-2.compute.amazonaws.com]: UNREACHABLE! => 
> {"changed": false, "msg": "Failed to connect to the host via ssh: 
> percent_expand: unknown key %C\r\n", "unreachable": true}" 
> ```
> This PR is to change the line to "control_path = ~/.ssh/ansbile-ssh-%%h-%%r" 
> to make amazon-ec2 also potentially deployable with Linux while preserving a 
> small path length. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #754: METRON-1184 EC2 Deployment - Updating control_path to acc...

2018-04-30 Thread lvets
Github user lvets commented on the issue:

https://github.com/apache/metron/pull/754
  
Sorry about this, testing it now.


---


[jira] [Commented] (METRON-571) Add stellar keywords for executing local commands

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-571?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458675#comment-16458675
 ] 

ASF GitHub Bot commented on METRON-571:
---

Github user devopsec closed the pull request at:

https://github.com/apache/metron/pull/439


> Add stellar keywords for executing local commands
> -
>
> Key: METRON-571
> URL: https://issues.apache.org/jira/browse/METRON-571
> Project: Metron
>  Issue Type: Improvement
>Reporter: Jon Zeolla
>Priority: Minor
> Attachments: ExternalFunctions.java, ExternalFunctionsTest.java
>
>
> Stellar should have the ability to execute scripts on a server in order to 
> undertake automated mitigation or alerting.  Perhaps SHELL_EXEC?



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[jira] [Commented] (METRON-571) Add stellar keywords for executing local commands

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-571?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458674#comment-16458674
 ] 

ASF GitHub Bot commented on METRON-571:
---

Github user devopsec commented on the issue:

https://github.com/apache/metron/pull/439
  
Sorry for the late notice, became too busy to finish at the moment, if 
there is reason for need I will merge and start a new PR, thanks for the input 
everyone!


> Add stellar keywords for executing local commands
> -
>
> Key: METRON-571
> URL: https://issues.apache.org/jira/browse/METRON-571
> Project: Metron
>  Issue Type: Improvement
>Reporter: Jon Zeolla
>Priority: Minor
> Attachments: ExternalFunctions.java, ExternalFunctionsTest.java
>
>
> Stellar should have the ability to execute scripts on a server in order to 
> undertake automated mitigation or alerting.  Perhaps SHELL_EXEC?



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron pull request #439: METRON-571 add stellar external functions feature ...

2018-04-30 Thread devopsec
Github user devopsec closed the pull request at:

https://github.com/apache/metron/pull/439


---


[GitHub] metron issue #439: METRON-571 add stellar external functions feature - code ...

2018-04-30 Thread devopsec
Github user devopsec commented on the issue:

https://github.com/apache/metron/pull/439
  
Sorry for the late notice, became too busy to finish at the moment, if 
there is reason for need I will merge and start a new PR, thanks for the input 
everyone!


---


[jira] [Commented] (METRON-1130) Updating README.md - Amazon EC2 deployment instructions

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1130?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458642#comment-16458642
 ] 

ASF GitHub Bot commented on METRON-1130:


Github user as22323 commented on the issue:

https://github.com/apache/metron/pull/713
  
Closing PR. 


> Updating README.md - Amazon EC2 deployment instructions
> ---
>
> Key: METRON-1130
> URL: https://issues.apache.org/jira/browse/METRON-1130
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.0
> Environment: $ cat /etc/centos-release
> ClearOS release 7.4.0
> ---
> ClearOS is based on CentOS
> 
> [x@x]# mvn -version
> Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5; 
> 2015-11-10T11:41:47-05:00)
> [x@x]# ansible --version
> ansible 2.2.2.0
> [x@x]# python -V
> Python 2.7.5
> [x@x]# git --version
> git version 1.8.3.1
> [x@x]# docker --version
> Docker version 1.12.6, build 88a4867/1.12.6
> [x@x]# npm --version
> 3.10.10
> [x@x]# node -v
> v6.11.1
> [x@x]# bzip2 -V
> bzip2, a block-sorting file compressor.  Version 1.0.6, 6-Sept-2010.
>Reporter: ashah
>Assignee: ashah
>Priority: Trivial
>  Labels: documentation, newbie, starter
> Fix For: 0.4.0
>
>
> PR is updating doc based on experience with installing 0.4.0 using a linux 
> env (ClearOS release 7.4.0 - ClearOS is based on CentOS).
> https://github.com/apache/metron/pull/713



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron pull request #713: METRON-1130 - Updating Amazon EC2 README.md

2018-04-30 Thread as22323
Github user as22323 closed the pull request at:

https://github.com/apache/metron/pull/713


---


[jira] [Commented] (METRON-1130) Updating README.md - Amazon EC2 deployment instructions

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1130?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458643#comment-16458643
 ] 

ASF GitHub Bot commented on METRON-1130:


Github user as22323 closed the pull request at:

https://github.com/apache/metron/pull/713


> Updating README.md - Amazon EC2 deployment instructions
> ---
>
> Key: METRON-1130
> URL: https://issues.apache.org/jira/browse/METRON-1130
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.0
> Environment: $ cat /etc/centos-release
> ClearOS release 7.4.0
> ---
> ClearOS is based on CentOS
> 
> [x@x]# mvn -version
> Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5; 
> 2015-11-10T11:41:47-05:00)
> [x@x]# ansible --version
> ansible 2.2.2.0
> [x@x]# python -V
> Python 2.7.5
> [x@x]# git --version
> git version 1.8.3.1
> [x@x]# docker --version
> Docker version 1.12.6, build 88a4867/1.12.6
> [x@x]# npm --version
> 3.10.10
> [x@x]# node -v
> v6.11.1
> [x@x]# bzip2 -V
> bzip2, a block-sorting file compressor.  Version 1.0.6, 6-Sept-2010.
>Reporter: ashah
>Assignee: ashah
>Priority: Trivial
>  Labels: documentation, newbie, starter
> Fix For: 0.4.0
>
>
> PR is updating doc based on experience with installing 0.4.0 using a linux 
> env (ClearOS release 7.4.0 - ClearOS is based on CentOS).
> https://github.com/apache/metron/pull/713



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #713: METRON-1130 - Updating Amazon EC2 README.md

2018-04-30 Thread as22323
Github user as22323 commented on the issue:

https://github.com/apache/metron/pull/713
  
Closing PR. 


---


[GitHub] metron issue #775: [METRON-1214] rpm build fails due to npm absence in Docke...

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/775
  
@DimDroll  Please close this PR unless you believe it is still needed.  
This PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[GitHub] metron issue #754: METRON-1184 EC2 Deployment - Updating control_path to acc...

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/754
  
@as22323  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[jira] [Commented] (METRON-1184) EC2 Deployment - Updating control_path to accommodate for Linux

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1184?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458604#comment-16458604
 ] 

ASF GitHub Bot commented on METRON-1184:


Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/754
  
@as22323  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> EC2 Deployment - Updating control_path to accommodate for Linux
> ---
>
> Key: METRON-1184
> URL: https://issues.apache.org/jira/browse/METRON-1184
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.1
> Environment: ClearOS[Distro of CentOS] npm 3.10.10, node 6.11.1, 
> docker 1.12.6, mvn 3.3.9, ansible 2.2.2.0, No Vagrant)
>Reporter: ashah
>Assignee: ashah
>Priority: Minor
>  Labels: amazon, cloud
> Fix For: Next + 1, 0.4.1
>
>
> PR: https://github.com/apache/metron/pull/754
> For 0.4.1-rc4, using "control_path = ~/.ssh/ansible-ssh-%%C" for a Linux 
> environment ( such as ClearOS[Distro of CentOS] npm 3.10.10, node 6.11.1, 
> docker 1.12.6, mvn 3.3.9, ansible 2.2.2.0, No Vagrant) could throw the 
> following error:
> ```
> "TASK [setup] 
> ***
> fatal: [ec2-xx-yy-0-130.us-west-2.compute.amazonaws.com]: UNREACHABLE! => 
> {"changed": false, "msg": "Failed to connect to the host via ssh: 
> percent_expand: unknown key %C\r\n", "unreachable": true}" 
> ```
> This PR is to change the line to "control_path = ~/.ssh/ansbile-ssh-%%h-%%r" 
> to make amazon-ec2 also potentially deployable with Linux while preserving a 
> small path length. 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[jira] [Commented] (METRON-1214) rpm build fails due to npm absence in Dockerfile

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1214?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458605#comment-16458605
 ] 

ASF GitHub Bot commented on METRON-1214:


Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/775
  
@DimDroll  Please close this PR unless you believe it is still needed.  
This PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> rpm build fails due to npm absence in Dockerfile 
> -
>
> Key: METRON-1214
> URL: https://issues.apache.org/jira/browse/METRON-1214
> Project: Metron
>  Issue Type: Bug
>Affects Versions: 0.4.1
>Reporter: Dima Kovalyov
>Priority: Minor
>
> I've received error in metron/metron-deployment/packaging/docker/rpm-docker 
> that npm is not installed, which failed the whole RPM build. To fix it I've 
> added npm to line 28 in Dockerfile:
> {code}
> RUN yum -y install asciidoc rpm-build rpm2cpio tar unzip xmlto zip rpmlint 
> npm && yum clean all
> {code}
> Requirement of npm was introduced after ui and rest addition.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[jira] [Commented] (METRON-1130) Updating README.md - Amazon EC2 deployment instructions

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1130?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458600#comment-16458600
 ] 

ASF GitHub Bot commented on METRON-1130:


Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/713
  
@as22323  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> Updating README.md - Amazon EC2 deployment instructions
> ---
>
> Key: METRON-1130
> URL: https://issues.apache.org/jira/browse/METRON-1130
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.0
> Environment: $ cat /etc/centos-release
> ClearOS release 7.4.0
> ---
> ClearOS is based on CentOS
> 
> [x@x]# mvn -version
> Apache Maven 3.3.9 (bb52d8502b132ec0a5a3f4c09453c07478323dc5; 
> 2015-11-10T11:41:47-05:00)
> [x@x]# ansible --version
> ansible 2.2.2.0
> [x@x]# python -V
> Python 2.7.5
> [x@x]# git --version
> git version 1.8.3.1
> [x@x]# docker --version
> Docker version 1.12.6, build 88a4867/1.12.6
> [x@x]# npm --version
> 3.10.10
> [x@x]# node -v
> v6.11.1
> [x@x]# bzip2 -V
> bzip2, a block-sorting file compressor.  Version 1.0.6, 6-Sept-2010.
>Reporter: ashah
>Assignee: ashah
>Priority: Trivial
>  Labels: documentation, newbie, starter
> Fix For: 0.4.0
>
>
> PR is updating doc based on experience with installing 0.4.0 using a linux 
> env (ClearOS release 7.4.0 - ClearOS is based on CentOS).
> https://github.com/apache/metron/pull/713



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #713: METRON-1130 - Updating Amazon EC2 README.md

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/713
  
@as22323  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[jira] [Commented] (METRON-1065) Grok pattern for Cisco ASA Parser expects syslog_pri

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-1065?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458597#comment-16458597
 ] 

ASF GitHub Bot commented on METRON-1065:


Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/670
  
@basvdl  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> Grok pattern for Cisco ASA Parser expects syslog_pri
> 
>
> Key: METRON-1065
> URL: https://issues.apache.org/jira/browse/METRON-1065
> Project: Metron
>  Issue Type: Improvement
>Affects Versions: 0.4.1
>Reporter: Bas van de Lustgraaf
>Priority: Minor
>
> The current grok pattern `CISCO_TAGGED_SYSLOG` expects to have a syslog 
> priority present at the start of each message. Unfortunately, this is not 
> always the case.
> *Currently supported:*
> {noformat}
> <162>Aug 05 2016 01:02:25: %ASA-2-106006: Deny inbound UDP from 
> 10.25.177.164/63279 to 10.2.52.71/161 on interface Inside
> {noformat}
> *Not supported by the current Grok pattern:*
> {noformat}
> Aug 05 2016 01:02:25: %ASA-2-106006: Deny inbound UDP from 
> 10.25.177.164/63279 to 10.2.52.71/161 on interface Inside
> {noformat}
> My suggestion would be to edit the `CISCO_TAGGED_SYSLOG` pattern to make the 
> following part optional: 
> {noformat}
> <%{POSINT:syslog_pri}>
> {noformat}
> And grep the severity from the `%ASA-4-106023` part. The part between the 
> hyphens, is the severity (source 
> http://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs-sev-level.html).



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #670: METRON-1065 grok pattern for cisco asa parser expects sys...

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/670
  
@basvdl  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[jira] [Commented] (METRON-854) Create DHCPDump Parser

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458596#comment-16458596
 ] 

ASF GitHub Bot commented on METRON-854:
---

Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/531
  
@basvdl  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> Create DHCPDump Parser
> --
>
> Key: METRON-854
> URL: https://issues.apache.org/jira/browse/METRON-854
> Project: Metron
>  Issue Type: New Feature
>Reporter: Bas van de Lustgraaf
>Priority: Minor
>  Labels: parser
>
> Create a DHCPDump parser. This information can be used during enrichment to 
> link ip-addresses to hostnames.
> {noformat}
> TIME: 2017-01-16 16:54:21.655|INTERFACE: eth2|OP:1 BOOTPREQUEST|CIADDR: 
> 172.20.75.77|YIADDR: 0.0.0.0|SIADDR: 0.0.0.0|GIADDR: 172.20.75.8|CHADDR: 
> fc:f8:ae:e8:ef:db:00:00:00:00:00:00:00:00:00:00|OPTION:  53   1 DHCP message 
> type: 8 |DHCPINFORM|OPTION:  61   7 Client-identifier: 
> 01:fc:f8:ae:e8:ef:db|OPTION:  12   5 Host name: Q1244|OPTION:  60   8 Vendor 
> class identifier: MSFT 5.0|OPTION:  55  13 Parameter Request List:   1 
> (Subnet mask)|| 15 (Domainname)||  3 (Routers)||  6 (DNS server)|| 44 
> (NetBIOS name server)|| 46 (NetBIOS node type)|| 47 (NetBIOS scope)|| 31 
> (Perform router discovery)|| 33 (Static route)||121 (Classless Static 
> Route)||249 (MSFT - Classless route)|| 43 (Vendor specific info)||252 (MSFT - 
> WinSock Proxy Auto Detect)|||IP: 10.10.10.177 > 172.20.1.11 | 
> b8:ca:3a:67:95:8a > 0:50:56:84:68:43
> TIME: 2017-01-16 17:13:14.548|INTERFACE: eth2|OP:1 BOOTPREQUEST|CIADDR: 
> 172.20.75.77|YIADDR: 0.0.0.0|SIADDR: 0.0.0.0|GIADDR: 172.20.75.8|CHADDR: 
> fc:f8:ae:e8:ef:db:00:00:00:00:00:00:00:00:00:00|OPTION:  53   1 DHCP message 
> type: 8 |DHCPINFORM|OPTION:  61   7 Client-identifier: 
> 01:fc:f8:ae:e8:ef:db|OPTION:  12   5 Host name: Q1244|OPTION:  60   8 Vendor 
> class identifier: MSFT 5.0|OPTION:  55  13 Parameter Request List:   1 
> (Subnet mask)|| 15 (Domainname)||  3 (Routers)||  6 (DNS server)|| 44 
> (NetBIOS name server)|| 46 (NetBIOS node type)|| 47 (NetBIOS scope)|| 31 
> (Perform router discovery)|| 33 (Static route)||121 (Classless Static 
> Route)||249 (MSFT - Classless route)|| 43 (Vendor specific info)||252 (MSFT - 
> WinSock Proxy Auto Detect)|||IP: 10.10.10.177 > 172.20.1.10 | 
> b8:ca:3a:67:95:8a > 0:50:56:b9:28:ac
> {noformat}



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #531: METRON-854 create dhcp dump parser

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/531
  
@basvdl  Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[jira] [Commented] (METRON-571) Add stellar keywords for executing local commands

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-571?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458592#comment-16458592
 ] 

ASF GitHub Bot commented on METRON-571:
---

Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/439
  
@devopsec Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> Add stellar keywords for executing local commands
> -
>
> Key: METRON-571
> URL: https://issues.apache.org/jira/browse/METRON-571
> Project: Metron
>  Issue Type: Improvement
>Reporter: Jon Zeolla
>Priority: Minor
> Attachments: ExternalFunctions.java, ExternalFunctionsTest.java
>
>
> Stellar should have the ability to execute scripts on a server in order to 
> undertake automated mitigation or alerting.  Perhaps SHELL_EXEC?



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #439: METRON-571 add stellar external functions feature - code ...

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/439
  
@devopsec Please close this PR unless you believe it is still needed.  This 
PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[jira] [Commented] (METRON-295) Script parsing bolt

2018-04-30 Thread ASF GitHub Bot (JIRA)

[ 
https://issues.apache.org/jira/browse/METRON-295?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16458591#comment-16458591
 ] 

ASF GitHub Bot commented on METRON-295:
---

Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/338
  
@rkarthik29  Please close this PR unless you believe it is still needed.  
This PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


> Script parsing bolt 
> 
>
> Key: METRON-295
> URL: https://issues.apache.org/jira/browse/METRON-295
> Project: Metron
>  Issue Type: New Feature
>Affects Versions: 0.2.2BETA
>Reporter: James Sirota
>Assignee: Karthik Narayanan
>Priority: Minor
>  Labels: newbie, platform
>
> In addition to having a Grok parsing bolt we need a bolt that can execute a 
> script in order to parse a telemetry.  This way you can still script the 
> parsing for telemetries for which Grok expressions are too complex, but still 
> don't have to define a java parser 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)


[GitHub] metron issue #338: METRON-295: Script parsing bolt

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/338
  
@rkarthik29  Please close this PR unless you believe it is still needed.  
This PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---


[GitHub] metron issue #278: Metron 451 SerDeUtils - java.lang.ClassNotFoundException:...

2018-04-30 Thread nickwallen
Github user nickwallen commented on the issue:

https://github.com/apache/metron/pull/278
  
@danieljue Please close this PR unless you believe it is still needed.  
This PR will be closed per the [Metron Development 
Guidelines](https://cwiki.apache.org/confluence/display/METRON/Development+Guidelines)
 on Inactive PRs, unless you provide some reasoning as to why it is stil 
needed. Thanks!


---