opnsense-plugins/security/etpro-telemetry

ETPRO telemetry edition

Telemetry tools, depends on rule-updater.config, which contains the device registration number provided by OPNsense.

for example.

# autogenerated, do not edit.
[__properties__]
et_telemetry.token=eeyahsei1nootu6aeJ5Eeghoohahxu4rahkiewu2bayeiv2eif

The scripts will be scheduled automatically using a cron job after installation of the ruleset / telemetry function.

General

All scripts described in the readme are available in the directory src/opnsense/scripts/etpro_telemetry

Requirements

Install requirements (default available on OPNsense)

pip install -r requires.txt

send_telemetry.py

Send anonymized telemetry data from Suricata eve log file, for details how the anonimisation works see EventCollector._get_local_networks() and `EventCollector.push()' where all local attached networks are used to strip off the first segments of the address before sending.

usage: send_telemetry.py [-h] [-e ENDPOINT] [-i] [-c CONFIG] [-l LOG]
                         [-s STATE]

optional arguments:
  -h, --help            show this help message and exit
  -e ENDPOINT, --endpoint ENDPOINT
                        Endpoint url to reach
  -i, --insecure        Insecure, skip certificate validation
  -c CONFIG, --config CONFIG
                        rule downloader configuration
  -l LOG, --log LOG     log directory containing eve.json files
  -s STATE, --state STATE
                        persistent state (and lock) filename
  -d DAYS, --days DAYS  Maximum number of days to look back on initial run
  -D, --direct          do not sleep before send (disable traffic spread)

to test using supplied configuration:

python send_telemetry.py -i -d 9999 -e https://endpoint -c testdata/rule-updater.config -l testdata/log/

State is saved /usr/local/var/run/et_telemetry.state by default.

send_heartbeat.py

Send a small heartbeat to proofpoint to signal the device is still active.

usage: send_heartbeat.py [-h] [-e ENDPOINT] [-i] [-c CONFIG]

optional arguments:
  -h, --help            show this help message and exit
  -e ENDPOINT, --endpoint ENDPOINT
                        Endpoint url to reach
  -i, --insecure        Insecure, skip certificate validation
  -c CONFIG, --config CONFIG
                        rule downloader configuration
  -D, --direct          do not sleep before send (disable traffic spread)
  -t, --test            test mode, output request/response to stdout

send_heartbeat.py

Dump suricata eve.log

usage: dump_data.py [-h] [-l LOG] [-t TIME] [-p] [-L LIMIT]

optional arguments:
  -h, --help            show this help message and exit
  -l LOG, --log LOG     log directory containing eve.json files
  -t TIME, --time TIME  max seconds to read from now()
  -p, --parsed          show data as shipped using send_telemetry
  -L LIMIT, --limit LIMIT
                        limit number of rows