Integrating Suricata with Jupitor Note book for Hybrid IDS

1

Dears any body can help am working on project with hybrids IDS and Wanted help to send EVE,Jason file which is not type alert and map it to jupitor note book to input the to Decision tree testing phase the specific quires listed below

→ how do i write a script that can automatically pick eve.json file split the file and retrive event that are not of type ‘Alert’
→ how can i generate labelled dataset from eve.json that can be used for machine learning classification algorithm mainly (Decision tree)
→ how do i map the event type that are not type alert and map it to pandas data frame change from labelled dataset to unlabbeled dataset

2

Hi,

  1. Just read the file in Python, looping over each line. For each line, decode the JSON and append the decoded data into a list. Keep in mind that it’s all in memory, it’s easy to run out if EVE file is large.
  2. pandas.json_normalize — pandas 2.1.3 documentation - just pass the resulting list to this method to get a dataframe. It handles nested JSON just fine but does not deal with lists of dictionaries;
  3. Write a python function that has only one input argument and one output. Input is the raw data as given by suricata, output is whatever label you need. Then apply over a dataframe column;

You can use this notebook for reference.