<?php
require_once ("ossim_db.inc");
class Event {
var $id;
var $timestamp;
var $sensor;
var $interface;
var $type;
var $plugin_id;
var $plugin_sid;
var $protocol;
var $src_ip;
var $dst_ip;
var $src_port;
var $dst_port;
var $condition;
var $value;
var $time_interval;
var $absolute;
var $priority;
var $reliability;
var $asset_src;
var $asset_dst;
var $risk_c;
var $risk_a;
var $asset_src;
var $asset_dst;
var $snort_sid;
var $snort_cid;
var $alarm;
function Event ($id, $timestamp, $sensor, $interface, $type,
$plugin_id, $plugin_sid, $protocol, $src_ip, $dst_ip,
$src_port, $dst_port, $condition, $value, $time_interval,
$absolute, $priority, $reliability, $risk_c, $risk_a,
$asset_src, $asset_dst, $snort_sid, $snort_cid, $alarm)
{
$this->id = $id;
$this->timestamp = $timestamp;
$this->sensor = $sensor;
$this->interface = $interface;
$this->type = $type;
$this->plugin_id = $plugin_id;
$this->plugin_sid = $plugin_sid;
$this->protocol = $protocol;
$this->src_ip = $src_ip;
$this->dst_ip = $dst_ip;
$this->src_port = $src_port;
$this->dst_port = $dst_port;
$this->condition = $condition;
$this->value = $value;
$this->time_interval = $time_interval;
$this->absolute = $absolute;
$this->priority = $priority;
$this->reliability = $reliability;
$this->risk_c = $risk_c;
$this->risk_a = $risk_a;
$this->asset_src = $asset_src;
$this->asset_dst = $asset_dst;
$this->snort_sid = $snort_sid;
$this->snort_cid = $snort_cid;
$this->alarm = $alarm;
}
function get_id() { return $this->id; }
function get_timestamp() { return $this->timestamp; }
function get_sensor() { return $this->sensor; }
function get_interface() { return $this->interface; }
function get_type() { return $this->type; }
function get_plugin_id() { return $this->plugin_id; }
function get_plugin_sid() { return $this->plugin_sid; }
function get_protocol() { return $this->protocol; }
function get_src_ip() { return $this->src_ip; }
function get_dst_ip() { return $this->dst_ip; }
function get_src_port() { return $this->src_port; }
function get_dst_port() { return $this->dst_port; }
function get_condition() { return $this->condition; }
function get_value() { return $this->value; }
function get_time_interval() { return $this->time_interval; }
function get_absolute() { return $this->absolute; }
function get_priority() { return $this->priority; }
function get_reliability() { return $this->reliability; }
function get_risk_c() { return $this->risk_c; }
function get_risk_a() { return $this->risk_a; }
function get_asset_src() { return $this->asset_src; }
function get_asset_dst() { return $this->asset_dst; }
function get_snort_sid() { return $this->snort_sid; }
function get_snort_cid() { return $this->snort_cid; }
function alarm() { return $this->alarm; }
function get_count($conn, $where = "")
{
$query = OssimQuery("SELECT count(*) FROM event $where");
if (!$rs = &$conn->Execute($query)) {
print $conn->ErrorMsg();
} else {
return $rs->fields["count(*)"];
}
}
function get_list($conn, $args = "", $inf = 0, $sup = 25)
{
$i = 0;
$query = OssimQuery("SELECT *, inet_ntoa(src_ip), inet_ntoa(dst_ip)
FROM event $args");
if (!$rs = &$conn->Execute($query)) {
print $conn->ErrorMsg();
} else {
$list = array();
while (!$rs->EOF) {
if (($i++ >= $inf) && ($inf++ <= $sup)) {
$list[] = new Event ( $rs->fields["id"],
$rs->fields["timestamp"],
$rs->fields["sensor"],
$rs->fields["interface"],
$rs->fields["type"],
$rs->fields["plugin_id"],
$rs->fields["plugin_sid"],
$rs->fields["protocol"],
$rs->fields["inet_ntoa(src_ip)"],
$rs->fields["inet_ntoa(dst_ip)"],
$rs->fields["src_port"],
$rs->fields["dst_port"],
$rs->fields["condition"],
$rs->fields["value"],
$rs->fields["time_interval"],
$rs->fields["absolute"],
$rs->fields["priority"],
$rs->fields["reliability"],
$rs->fields["risk_c"],
$rs->fields["risk_a"],
$rs->fields["asset_src"],
$rs->fields["asset_dst"],
$rs->fields["snort_sid"],
$rs->fields["snort_cid"],
$rs->fields["alarm"]);
} elseif ($inf > $sup) {
break;
}
$rs->MoveNext();
}
}
return $list;
}
function delete($conn, $id)
{
if (!strcmp($id, "all")) {
$sql = "DELETE FROM event";
$params = array();
} else {
$sql = "DELETE FROM event WHERE id = ?";
$params = array($id);
}
if ($conn->Execute($sql, $params) === false) {
print ‘error deleting: ‘.$conn->ErrorMsg().‘<BR>‘;
}
}
}
?>