DeepFal
2d76ed6672
- 特征检测（规则/签名）与行为检测（24h 统计）单进程运行 - 融合名单按首次发现时间倒序，展示位置/归属（GeoIP + ASN） - 钉钉融合推送（加签、24h 节流、去重） - 页面状态灯、CSV 导出、Docker 镜像构建文件
51 lines
1.3 KiB
Python
51 lines
1.3 KiB
Python
"""Preview the CLI output without a real Graylog instance.
|
|
|
|
Runs a handful of commands against the bundled fake Graylog 4.0 server so you
|
|
can see the exact shape of the tables/JSON before pointing the tool at
|
|
edu-master.
|
|
|
|
python3 tests/demo.py
|
|
"""
|
|
|
|
import io
|
|
import os
|
|
import sys
|
|
from contextlib import redirect_stdout
|
|
|
|
HERE = os.path.dirname(os.path.abspath(__file__))
|
|
sys.path.insert(0, os.path.dirname(HERE))
|
|
sys.path.insert(0, HERE)
|
|
|
|
from fake_graylog import JUDGE_MESSAGES, FakeGraylog # noqa: E402
|
|
from graylog_ops import cli # noqa: E402
|
|
|
|
COMMANDS = (
|
|
["probe"],
|
|
["streams"],
|
|
["discover", "--range", "3600"],
|
|
["top-ips", "--field", "client_ip", "--query", "status:401", "--size", "5"],
|
|
["judge", "--range", "300", "--explain", "3"],
|
|
)
|
|
|
|
|
|
def main():
|
|
server = FakeGraylog(messages=JUDGE_MESSAGES).start()
|
|
base = ["--url", server.url, "--token", "testtoken"]
|
|
try:
|
|
for command in COMMANDS:
|
|
print("=" * 78)
|
|
print("$ graylog-ops " + " ".join(command))
|
|
print("-" * 78)
|
|
captured = io.StringIO()
|
|
with redirect_stdout(captured):
|
|
cli.main(base + command)
|
|
print(captured.getvalue().rstrip())
|
|
print()
|
|
finally:
|
|
server.stop()
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|