Re: [Nepenthes-devel] Dionaea plugin

[Markus <nep...@gm...>]

Hi,

On Thu, Apr 21, 2011 at 8:24 AM, Khaled Yakdan <kha...@gm...> wrote:
> I am now writing a python script for dionaea to that gets notified when an
> attack occurs, it then needs to send the attack related information to a
> remote machine.

had a look on xmpp already? http://carnivore.it/start?btng[post][tags]=xmpp
there is even a webinterface for it - http://ore.carnivore.it/

> What I know so far is that a new class that inherits from
> ihandler should be defined, but I could not find the functions defined in
> ihandler that I can override. If someone has this information it would be
> really beneficial. I would also appreciate it if someone could provide my
> with a short tutorial regarding incidents and ihandlers.

default is
handle_incident()
but you can define methods like
handle_incident_dionaea_connection_tcp_accept
for the incident with path "dionaea.connection.tcp.accept", so you do
not need to multiplex in handle_incident.

http://src.carnivore.it/dionaea/tree/modules/python/scripts/logxmpp.py#n564
as an example.


Markus